GHSA-42hx-vrxx-5r6v

Jodit Editor vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23461

Packages

Ecosystem	Package	Affected	Fixed in
npm	jodit	<= 3.24.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23461 advisory
https://github.com/xdan/jodit package
https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit advisory