Cross-Site Scripting (XSS)

2023-04-1714:13:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

xss

editor.md

vulnerability

javascript

browser

injection

parameter

sanitization

0.001 Low

EPSS

Percentile

41.8%

JSON

editor.md is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to a lack of sanitization in the src, parameter of editormd.js which allows an attacker to inject and execute arbitrary JavaScript into the browser.

CPENameOperatorVersion
editor.mdeq1.5.0
editor.mdeq1.5.0
editor.mdle1.5.0
editor.mdeq1.5.0
editor.mdeq1.5.0
editor.mdle1.5.0

Name	Operator	Version
editor.md	eq	1.5.0
editor.md	eq	1.5.0
editor.md	le	1.5.0
editor.md	eq	1.5.0
editor.md	eq	1.5.0
editor.md	le	1.5.0

References

github.com/advisories/GHSA-w974-rq9x-mh3v

github.com/pandao/editor.md/pull/860

github.com/pandao/editor.md/pull/860/commits/2a6ef977f76779df14798aba3bc4528ca4d8a78d

0.001 Low

EPSS

Percentile

41.8%

JSON

Related for VERACODE:40138