Editor.js vulnerable to Code Injection

Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Recommendation

Update the @editorjs/editorjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.26.0
• Patched version(s): 2.26.0

References

• GHSA-6mvj-2569-3mcm
• CVE-2022-23474
• CWE-79
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Joplin Vulnerable to Code Injection - CVE-2022-23340
• Eta vulnerable to Code Injection via templates rendered with user-defined data - CVE-2022-25967
• cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch - CVE-2022-36084
• lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@editorjs/editorjs