GHSA-25fq-6qgg-qpj8
SCEditor has DOM XSS via emoticon URL/HTML injection
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
If an attacker has the ability control configuration options passed to `sceditor.create()`, like `emoticons`, `charset`, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options.
Proof of concept:
```js
sceditor.create(textarea, {
emoticons: {
dropdown: { ':)': { url: 'x" onerror="window.__xss = true' } }
}
});
```
References
External links from the advisory. They lead to third-party sites.