Skip to content
OpenAdvisories
Medium USN-4522-1 1 CVE

novnc vulnerability

Published Sep 21, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that noVNC did not properly manage certain messages,
resulting in the remote VNC server injecting arbitrary HTML into the
noVNC web page. An attacker could use this issue to conduct cross-site
scripting (XSS) attacks. (CVE-2017-18635)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS novnc 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2017-18635 Public exploit

    Cross-Site Scripting in @novnc/novnc

    An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

    novnc @novnc/novnc novnc Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2017-18635