Cross-site scripting in @atlaskit/editor-core

Description

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

Recommendation

No fix is available yet. Followings are affected versions:

< 113.1.5

References

GHSA-p5ch-w78f-xh44
atlaskit.atlassian.com
bitbucket.org
confluence.atlassian.com
www.npmjs.com
CVE-2019-20903
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cross-site scripting in @atlaskit/editor-core and gives you actionable findings to investigate.

Start a free scan

Related Issues

DOM-based cross-site scripting in Froala Editor - CVE-2019-19935
Cross-Site Scripting in editor.md - CVE-2019-9737
Cross-site Scripting in pandao editor.md - CVE-2019-14517
editor.md vulnerable to Cross-site Scripting - CVE-2023-29641

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 01, 2023