Cross-Site Scripting in wangeditor

Description

All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0

References

• GHSA-g7mw-5cq6-fv82
• snyk.io
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
• TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
• CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815
• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

wangeditor