Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter

Description

Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.0

References

• GHSA-5p84-mmh9-pxgr
• CVE-2020-19698
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter - CVE-2020-19697
• editor.md vulnerable to Cross-site Scripting - CVE-2023-29641
• Cross-site Scripting in pandao editor.md - CVE-2019-14517
• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349

Tags:

npm

editor.md