Cross site scripting in froala-editor

Description

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.

Recommendation

Update the froala-editor package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.6
• Patched version(s): 4.0.11

References

• GHSA-97x5-cc53-cv4v
• www.youtube.com
• CVE-2020-22864
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in jquery-deparam - CVE-2021-20087
• Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592
• files.photo.gallery command injection - CVE-2024-53615

Tags:

npm

froala-editor