react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript:
URi in a Link Target of the link decorator in decorators/Link/index.js
when a draft is shared across users, leading to XSS.
{ "github_reviewed_at": "2021-04-26T18:46:48Z", "cwe_ids": [ "CWE-79" ], "nvd_published_at": "2021-04-24T21:15:00Z", "severity": "MODERATE", "github_reviewed": true }