GHSA-6mvj-2569-3mcm

Editor.js vulnerable to Code Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23474

Packages

Ecosystem	Package	Affected	Fixed in
npm	@editorjs/editorjs	< 2.26.0	2.26.0

Details

As written in the advisory (Markdown source, shown as plain text).

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23474 advisory
https://github.com/codex-team/editor.js/pull/2100 web
https://github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2 web
https://github.com/codex-team/editor.js package
https://securitylab.github.com/advisories web
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js advisory