Cross-Site Scripting in @progress/kendo-angular-editor

Description

Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.

Recommendation

Update the @progress/kendo-angular-editor package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.2.3
• Patched version(s): 1.2.3

References

• GHSA-j7wp-vjj6-cp5m
• stackblitz.com
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting in mavon-editor - Vulnerability
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support - CVE-2022-31175
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-markdown-gfm - CVE-2022-31175

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@progress/kendo-angular-editor