GHSA-9hfw-cvf4-5x25

wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25037

Packages

Ecosystem	Package	Affected	Fixed in
npm	@wangeditor/editor	< 4.7.12	4.7.12

Details

As written in the advisory (Markdown source, shown as plain text).

There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25037 advisory
https://github.com/wangeditor-team/wangEditor/issues/3870 web
https://github.com/wangeditor-team/wangEditor/issues/3872 web
https://github.com/wangeditor-team/wangEditor/commit/6257a2e166346913c34ac5cfb31b6a46e9544c5a web
https://gist.github.com/Mdxjj/5cf0a31e8abf24ed688ceb5b3543516d web
https://github.com/wangeditor-team/wangEditor package