GHSA-p5ch-w78f-xh44

Cross-site scripting in @atlaskit/editor-core

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-20903

Packages

Ecosystem	Package	Affected	Fixed in
npm	@atlaskit/editor-core	< 113.1.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-20903 advisory
https://atlaskit.atlassian.com/packages/editor/editor-core/changelog/113.1.5 web
https://bitbucket.org/atlassian/atlaskit-mk-2/commits/ca88f616e4 web
https://confluence.atlassian.com/pages/viewpage.action?pageId=1021244735 web
https://www.npmjs.com/package/@atlaskit/editor-core web