GitHub Advisoryadvisory · npm

GHSA-42hx-vrxx-5r6v Jodit Editor vulnerable to Cross-site Scripting

MEDIUM Published 2022-09-25 Modified 2022-09-27 Official page ↗
Aliases
CVE-2022-23461
Ecosystem
npm
Packages
jodit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-09-27

Affected packages

• npm jodit: <= 3.24.2 (no fix yet)

Description

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-23461 Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References