Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter

Description

Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe> src parameter.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.0

References

• GHSA-w974-rq9x-mh3v
• CVE-2020-19697
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components - CVE-2025-1647
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• Sending a GET or HEAD request with a body crashes SvelteKit (GHSA-g5m6-hxpp-fc49) - CVE-2024-23641
• msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079

Tags:

npm

editor.md