Cross-site Scripting in jsoneditor

Description

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.

Recommendation

Update the jsoneditor package to the latest compatible version. Followings are version details:

• Affected version(s): < 9.0.2
• Patched version(s): 9.0.2

References

• GHSA-q854-j362-cfq9
• CVE-2020-23849
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in jsoneditor - CVE-2021-3822
• Cross-site scripting in Swagger-UI - CVE-2019-17495
• Path Traversal in simplehttpserver - CVE-2018-16478
• Cross-Site Scripting in html-pages - CVE-2018-16481

Tags:

npm

jsoneditor