GHSA-97x5-cc53-cv4v

Cross site scripting in froala-editor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-22864

Packages

Ecosystem	Package	Affected	Fixed in
npm	froala-editor	< 4.0.11	4.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-22864 advisory
https://github.com/froala/wysiwyg-editor/issues/3880 web
https://github.com/418sec/wysiwyg-editor/pull/1 web
https://github.com/froala/wysiwyg-editor/pull/3911 web
https://github.com/froala/wysiwyg-editor package
https://github.com/froala/wysiwyg-editor/releases/tag/v4.0.11 web
https://www.youtube.com/watch?v=WE3b1iSnWJY web