Simditor XSS Vulnerability

Description

Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.11

References

• GHSA-p9wj-wrrm-84m5
• CVE-2018-6464
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• XSS vulnerability that affects bootstrap - CVE-2018-20676
• XSS vulnerability that affects bootstrap (GHSA-3mgp-fx93-9xv5) - CVE-2018-20676
• Pandao editor.md vulnerable to DOM XSS - CVE-2018-19056
• Pandao editor.md vulnerable to XSS in IMG attributes - CVE-2018-16330

Tags:

npm

simditor