Imported RichEditor custom block previews can be used for XSS
Résumé
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the p...
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| composer | filament/forms |
>= 4.0.0, < 4.15.0 |
>= 4.15.0 |
| composer | filament/forms |
>= 5.0.0, < 5.10.0 |
>= 5.10.0 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
The RichEditor trusts preview metadata embedded in imported custom block HTML. When a user pastes or drops HTML containing a custom block with a crafted data-preview attribute, the editor decodes the value and renders it without sanitization. An attacker can therefore execute JavaScript in the panel's origin when a user copies content from an attacker-controlled page and pastes it into the editor.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY filamentphp/filament