CVE-2021-25989: In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor

Routine

MEDIUM 5.4UPGRADE

CVE-2021-25989 is a medium-severity flaw (CVSS 5.4) affecting ifme. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.6% (top 50%)
CISA exploited list	No
Weakness	CWE-79
Published	2021-12-29
Last modified	2026-06-17

Publisher (CNA): Mend · Vendor: if-me

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-12-29 09:15 UTCPublished CVE record published
2026-06-17 03:42 UTCUpdated Record last modified

if-me ifme UPGRADE

Affected: >= 1.0.0 and <= 7.31.4

Fixed in: newer than 7.31.4

Safe to downgrade to: a release before 1.0.0

1. Check installed version

apt-cache policy ifme || rpm -q ifme || ifme --version

2. UPGRADE to newer than 7.31.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade ifme

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade ifme

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 1.0.0 (Debian / Ubuntu)

apt-cache madison ifme sudo apt install ifme=<VERSION_BEFORE_1.0.0> sudo apt-mark hold ifme

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list ifme sudo dnf downgrade ifme-<VERSION_BEFORE_1.0.0> sudo dnf versionlock add ifme

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-25989?

ifme: upgrade to newer than 7.31.4. Exact commands for each OS are on this page.

Is CVE-2021-25989 being exploited?

CVE-2021-25989 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-25989 affect?

CVE-2021-25989 affects ifme. Severity is medium (CVSS 5.4). In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.

How urgent is CVE-2021-25989?

Priority 37/100. Public exploit reference

Related CVEs

CVE-2021-25992 CRITICAL 9.8 UPGRADE In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated l
CVE-2021-25991 MEDIUM 5.7 UPGRADE In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible f
CVE-2021-25990 MEDIUM 5.4 UPGRADE In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allo
CVE-2021-25988 MEDIUM 5.4 UPGRADE In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) w

References

← Back to latest CVEs