WS-2020-0102

@toast-ui/editor through 2.1.2 is vulnerable to Cross-Site Scripting XSS. There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser...

GHSA-CR56-66MX-293V Cross-Site Scripting in @toast-ui/editor

Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting XSS. There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser. Recommendation Upgrade to version 2.2.0 or later...

Cross-Site Scripting in @toast-ui/editor

Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting XSS. There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser. Recommendation Upgrade to version 2.2.0 or later...

PT-2020-21246

Name of the Vulnerable Software and Affected Versions @toast-ui/editor versions prior to 2.2.0 Description The issue allows attackers to execute arbitrary JavaScript on a victim's browser due to multiple bypasses of the package's built-in XSS sanitization, which may lead to Cross-Site Scripting...

Cross-site Scripting (XSS)

Overview @toast-ui/editor is a GFM Markdown Wysiwyg Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. JavaScript inserted into the editor is not sanitized by the library. PoC " src=x onerror="alert1" alert1" alert1" alert1" Details Cross-site scripting or XSS i...