~ / search / GHSA-cxm3-v4mv-6mh8

GHSA-cxm3-v4mv-6mh8

vditor Vulnerable to Cross-site Scripting in SVG events

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-4103

Packages

EcosystemPackageAffectedFixed in
npm vditor < 3.8.11 3.8.11

Details

As written in the advisory (Markdown source, shown as plain text).

vditor does not filter user input in SVG events, leading to XSS ### PoC ```html </a> <svg><animate onbegin=alert(11) attributeName=x dur=1s> ```

References

External links from the advisory. They lead to third-party sites.