EpicEditor XSS Vulnerability

Description

EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.2.3

References

• GHSA-4wc5-gfgh-4vjx
• bad.code.blog
• CVE-2017-6589
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• rendertron XSS vulnerability - CVE-2017-18352
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357
• XSS vulnerability that affects bootstrap - bootstrap - CVE-2018-20676
• Vercel ms Inefficient Regular Expression Complexity vulnerability - CVE-2017-20162

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

epiceditor