CVE-2022-23474

Editor.js (block-style editor) vulnerable before 2.26.0 due to Code Injection via pasted input. Root cause: processHTML passes pasted input into the wrapper’s innerHTML. Patched in 2.26.0. Public references cover this CVE across multiple sources; one connected record notes a PoC/exploitation deta...