Cross-Site Scripting (XSS)

2023-05-1213:07:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

editor.md

filterhtmltags

javascript injection

software vulnerability

0.001 Low

EPSS

Percentile

35.3%

JSON

editor.md is vulnerable to Cross-Site Scripting (XSS). The vulnerability exists in filterHTMLTags function at editormd.js because the inputs are not properly filtered which allows an attacker to inject and execute arbitrary JavaScript.

CPENameOperatorVersion
editor.mdeq1.5.0
editor.mdeq1.5.0
editor.mdle1.5.0
editor.mdeq1.5.0
editor.mdeq1.5.0
editor.mdle1.5.0

Name	Operator	Version
editor.md	eq	1.5.0
editor.md	eq	1.5.0
editor.md	le	1.5.0
editor.md	eq	1.5.0
editor.md	eq	1.5.0
editor.md	le	1.5.0

References

github.com/advisories/GHSA-rpr9-qfw3-wh83

github.com/alromh87/editor.md/commit/f5cb82c39400294a75f4b5b9e997e4939cee7084

github.com/pandao/editor.md

github.com/pandao/editor.md/issues/697

0.001 Low

EPSS

Percentile

35.3%

JSON

Related for VERACODE:40491