GitHub Advisoryadvisory · npm

GHSA-p9wj-wrrm-84m5 Simditor XSS Vulnerability

MEDIUM Published 2022-05-13 Modified 2023-10-06 Official page ↗

Aliases: CVE-2018-6464
Ecosystem: npm
Packages: simditor
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2023-07-21

Affected packages

• npm simditor: <= 2.3.11 (no fix yet)

Description

Simditor v2.3.11 allows XSS via crafted use of `svg/onload=alert` in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Related

Alias · CVE (1)

CVE-2018-6464 Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References