Cross-site Scripting (XSS)

2022-03-1504:29:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vditor

xss

vulnerability

url

javascript

markdown

EPSS

0.001

Percentile

21.4%

JSON

vditor is vulnerable to cross-site scripting. The vulnerability exists because the library does not properly encode the double-quotes in the url, allowing an attacker to escape the href attribute and inject and execute malicious javascript via the links using markdown syntax.