GitHub Advisoryadvisory · npm

GHSA-g7mw-5cq6-fv82 Cross-Site Scripting in wangeditor

HIGH Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
wangeditor
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm wangeditor: all versions (no fix yet)

Description

All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References