GitHub Advisoryadvisory · npm

GHSA-m5jf-8crm-r65m Vditor allows Cross-site Scripting via an attribute of an `A` element

MEDIUM Published 2024-05-03 Modified 2024-05-03 Official page ↗

Aliases: CVE-2024-34449
Ecosystem: npm
Packages: vditor
Severity: Moderate
Weaknesses: CWE-79
Reviewed: 2024-05-03

Affected packages

• npm vditor: 3.10.3 (no fix yet)

Description

Vditor 3.10.3 allows XSS via an attribute of an `A` element. NOTE: the vendor indicates that a user is supposed to mitigate this via `sanitize=true`.

Related

Alias · CVE (1)

CVE-2024-34449 Vditor 3.10.3 allows XSS via an attribute of an A element. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References