Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will…

Description

Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.

Scores

EPSS (exploitation in 30 days)

1.00% · top 37% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80) (opens in a new tab)All about CWE-80 and its CVEs
• CWE-74 (opens in a new tab)All about CWE-74 and its CVEs

Affected products

• HackerOne · shout node module

  • affected >=0.44.0 <=0.49.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmshoutGHSA-26q7-g57v-mxcp (opens in a new tab)

References (2)

• https://github.com/erming/shout/pull/344 (opens in a new tab)x_refsource_MISCx_transferred
• https://nodesecurity.io/advisories/322 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-26q7-g57v-mxcp (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-16043](https://trackcve.app/badge/CVE-2017-16043.svg)](https://trackcve.app/cve/CVE-2017-16043)

Record last updated 16 Sept 2024, 16:58 UTC.