~ / search / GHSA-8v67-x8q5-3x3g

GHSA-8v67-x8q5-3x3g

Cross-Site Scripting in simditor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-19048

Packages

EcosystemPackageAffectedFixed in
npm simditor < 2.3.22 2.3.22

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `simditor` prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with `innerHTML`, allowing attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 2.3.22 or later.

References

External links from the advisory. They lead to third-party sites.