Remote Code Execution

2022-12-1607:13:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

@editorjs/editorjs

vulnerable

pasted input

innerhtml method

malicious code

system security

0.001 Low

EPSS

Percentile

35.4%

JSON

@editorjs/editorjs is vulnerable to remote code execution. An attacker is able to upload and execute malicious code on the system via pasted input into wrapper’s innerHTML method.

CPENameOperatorVersion
@editorjs/editorjsle2.26.0-rc.0
@editorjs/editorjsle2.26.0-rc.0

CPE	Name	Operator	Version
	@editorjs/editorjs	le	2.26.0-rc.0
	@editorjs/editorjs	le	2.26.0-rc.0

References

github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2

github.com/codex-team/editor.js/issues/2208

github.com/codex-team/editor.js/pull/2100

securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/

0.001 Low

EPSS

Percentile

35.4%

JSON

Related for VERACODE:38518