GitHub Advisoryadvisory · npm

GHSA-qcg2-h349-vwm3 Cross-site Scripting in React Draft Wysiwyg

MEDIUM Published 2021-05-06 Modified 2023-09-11 Official page ↗
Aliases
CVE-2021-31712
Ecosystem
npm
Packages
react-draft-wysiwyg
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-26

Affected packages

• npm react-draft-wysiwyg: < 1.14.6 → fixed in 1.14.6

Description

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a `javascript:` URi in a Link Target of the link decorator in `decorators/Link/index.js` when a draft is shared across users, leading to XSS.

Related

Alias · CVE (1)

  • CVE-2021-31712 react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References