Cross-site Scripting in Froala Editor (GHSA-cq6w-w5rj-p9x8)

Description

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.2.6

References

• GHSA-cq6w-w5rj-p9x8
• froala.com
• CVE-2021-30109
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DOM-based cross-site scripting in Froala Editor - CVE-2019-19935
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592
• Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434
• Cross site scripting in froala-editor - CVE-2020-22864

Tags:

npm

froala-editor