Cross-Site Scripting in @toast-ui/editor
High severity
GitHub Reviewed
Published
Sep 3, 2020
to the GitHub Advisory Database
•
Updated Apr 3, 2023
Description
Reviewed
Aug 31, 2020
Published to the GitHub Advisory Database
Sep 3, 2020
Last updated
Apr 3, 2023
Credits
-
tdunlap607 Analyst
Versions of
@toast-ui/editorprior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.Recommendation
Upgrade to version 2.2.0 or later.
References