CVE-2021-28079

Name of the Vulnerable Software and Affected Versions: Jamovi versions prior to 1.6.19

Description: A cross-site scripting (XSS) issue affects Jamovi, where the column-name is vulnerable in the ElectronJS Framework. An attacker can create a .omv document containing a malicious payload. When this document is opened by a victim, the payload is triggered.

Recommendations: For Jamovi versions prior to 1.6.19, update to version 1.6.19 or later to resolve the issue. As a temporary workaround, consider avoiding the use of user-provided .omv documents until the update is applied.