GHSA-cq6w-w5rj-p9x8

Cross-site Scripting in Froala Editor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-30109

Packages

Ecosystem	Package	Affected	Fixed in
npm	froala-editor	<= 3.2.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-30109 advisory
https://github.com/Hackdwerg/CVE-2021-30109/blob/main/README.md web
https://github.com/froala/wysiwyg-editor-release package
http://froala.com web