MEDIUM6.1

GHSA-cq6w-w5rj-p9x8

Cross-site Scripting in Froala Editor

Details

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/froala-editor

Introduced in: 0

No fixed version published yet for froala-editor (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-30109[ADVISORY]
https://github.com/Hackdwerg/CVE-2021-30109/blob/main/README.md[WEB]
https://github.com/froala/wysiwyg-editor-release[PACKAGE]
http://froala.com[WEB]