~ / search / GHSA-x3g3-334f-q6h4

GHSA-x3g3-334f-q6h4

Pandao editor.md vulnerable to DOM XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-19056

Packages

EcosystemPackageAffectedFixed in
npm editor.md 1.5.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

pandao Editor.md 1.5.0 has DOM XSS via input starting with a `<<` substring, which is mishandled during construction of an `A` element.

References

External links from the advisory. They lead to third-party sites.