GHSA-w974-rq9x-mh3v

Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-19697

Packages

Ecosystem	Package	Affected	Fixed in
npm	editor.md	<= 1.5.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the `<iframe> src` parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-19697 advisory
https://github.com/pandao/editor.md/issues/701 web
https://github.com/pandao/editor.md/pull/860 web
https://github.com/pandao/editor.md package