Imported RichEditor custom block previews can be used for XSS
Summary
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the p...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| composer | filament/forms |
>= 4.0.0, < 4.15.0 |
>= 4.15.0 |
| composer | filament/forms |
>= 5.0.0, < 5.10.0 |
>= 5.10.0 |
Original description The description as published by the source.
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the panel's origin when a user copies content from an attacker-controlled page and pastes it into the editor.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY filamentphp/filament