CVE-2022-23474
editor.js contains Code Injection
Résumé
editor.js contains Code Injection
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory securitylab.github.com
- patch github.com