Description
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-sidekiq | 6.3.1+dfsg-1 | — |
| Debian 13 | ruby-sidekiq | 6.3.1+dfsg-1 | — |
| Debian 12 | ruby-sidekiq | 6.3.1+dfsg-1 | — |
| Debian 11 | ruby-sidekiq | 6.0.4+dfsg-2+deb11u1 | DLA-4407-1 |
| Debian 10 | ruby-sidekiq | 5.2.3+dfsg-1+deb10u1 | DLA-3360-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | ruby-sidekiq | 4.2.3+dfsg-1+deb9u1 | DLA-2943-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby-sidekiq | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ruby-sidekiq | 6.3.1+dfsg-1ubuntu0.1~esm1 | USN-7695-1 |
| Ubuntu Pro 20.04 LTS | ruby-sidekiq | 5.2.7+dfsg-1ubuntu0.1~esm1 | USN-7695-1 |
| Ubuntu Pro 18.04 LTS | ruby-sidekiq | 5.0.4+dfsg-2ubuntu0.1~esm1 | USN-7695-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Utils 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite Capsule 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | candlepin | 4.1.13-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | foreman | 3.1.1.21-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | libsolv | 0.7.22-1.el7pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-django +1 | 3.2.13-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-lxml | 4.7.1-1.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | python-sqlparse | 0.4.2-2.el8pc | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-actionpack | 6.0.4.7-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-puma | 5.6.2-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | rubygem-sidekiq | 5.2.10-1.el8sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | satellite | 6.11.0-2.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-actionpack | 6.0.4.7-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-puma | 5.6.2-1.el7sat | RHSA-2022:5498 |
| Red Hat Satellite 6 | tfm-rubygem-sidekiq | 5.2.10-1.el7sat | RHSA-2022:5498 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:5498 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Sidekiq <=6.2.0 - Cross-Site Scripting http/cves/2021/CVE-2021-30151.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | sidekiq | < 5.2.0 | 5.2.0 | GHSA-grh7-935j-hg6w |
| RubyGems | sidekiq | >= 6.0.0, < 6.2.1 | 6.2.1 | GHSA-grh7-935j-hg6w |
Advisories 6
- RHSA-2022:5498 Red Hat Security Advisory: Satellite 6.11 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-7695-1 ruby-sidekiq vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2943-1 ruby-sidekiq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3360-1 ruby-sidekiq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:5498 Moderate: Satellite 6.11 Release Rocky Linux Security Advisories · Feb 5, 2026
- DLA-4407-1 ruby-sidekiq - security update Debian Security (DSA / DLA) · Dec 15, 2025