GHSA-g7mw-5cq6-fv82

Source

https://github.com/advisories/GHSA-g7mw-5cq6-fv82

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g7mw-5cq6-fv82/GHSA-g7mw-5cq6-fv82.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g7mw-5cq6-fv82

Published

2020-09-02T21:20:40Z

Modified

2021-09-27T21:00:38Z

Summary

Cross-Site Scripting in wangeditor

Details

All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:39:03Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / wangeditor

Package

Name: wangeditor; View open source insights on deps.dev
Purl: pkg:npm/wangeditor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g7mw-5cq6-fv82/GHSA-g7mw-5cq6-fv82.json"