GitHub Advisoryadvisory · npm

GHSA-6mvj-2569-3mcm Editor.js vulnerable to Code Injection

MEDIUM Published 2024-08-05 Modified 2024-08-05 Official page ↗
Aliases
CVE-2022-23474
Ecosystem
npm
Packages
@editorjs/editorjs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-94
Reviewed
2024-08-05

Affected packages

• npm @editorjs/editorjs: < 2.26.0 → fixed in 2.26.0

Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Related

Alias · CVE (1)

  • CVE-2022-23474 Editor.js is a block-style editor with clean JSON output. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References