Cross site scripting in froala-editor

Description

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.

Recommendation

Update the froala-editor package to the latest compatible version. Followings are version details:

Affected version(s): <= 4.0.6
Patched version(s): 4.0.11

References

GHSA-97x5-cc53-cv4v
www.youtube.com
CVE-2020-22864
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cross site scripting in froala-editor and gives you actionable findings to investigate.

Start a free scan

Related Issues

DOM-based cross-site scripting in Froala Editor - CVE-2019-19935
Cross-site Scripting in Froala Editor - froala-editor - CVE-2021-30109
Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434
Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 13, 2023