CVE-2022-23474

2022-12-1519:15:16

Google

osv.dev

editor.js

code injection

vulnerability

patched

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.4%

JSON

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

CPENameOperatorVersion
editor.jseq2.19.0
editor.jseq2.26.0-rc.1
editor.jseq2.24.0
editor.jseq2.20.0
editor.jseq2.19.2-rc.0
editor.jseq2.23.0-rc.1
editor.jseq2.23.0
editor.jseq2.22.0
editor.jseq1.4.0
editor.jseq2.26.0-rc.5

Name	Operator	Version
editor.js	eq	2.19.0
editor.js	eq	2.26.0-rc.1
editor.js	eq	2.24.0
editor.js	eq	2.20.0
editor.js	eq	2.19.2-rc.0
editor.js	eq	2.23.0-rc.1
editor.js	eq	2.23.0
editor.js	eq	2.22.0
editor.js	eq	1.4.0
editor.js	eq	2.26.0-rc.5