@yeepay/lowcode-engine (>=1.0.0-beta.1, <=2.3.12), @yeepay/lowcode-markdown (>=2.2.0-beta.0, <=2.6.4) potentially affected by CVE-2021-32855 via vditor (3.3.9)

vditor NPM version 3.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on vditor and may be impacted: - @yeepay/lowcode-engine =1.0.0-beta.1, =2.2.0-beta.0, =2.6.4 Source cves: CVE-2021-32855 Source advisory: OSV:GHSA-VFMP-9999-6WQJ...

CVE-2021-32855

The CVE-2021-32855 entry concerns Vditor, a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS) where an attacker must lure a user into pasting a malicious payload into the editor. The vulnerability is mitigated in version 3.8.7, which con...