MEDIUM5.4

GHSA-qcg2-h349-vwm3

Cross-site Scripting in React Draft Wysiwyg

Quick fix

GHSA-qcg2-h349-vwm3 — react-draft-wysiwyg: upgrade to the fixed version with the command below.

npm install react-draft-wysiwyg@1.14.6

Details

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a `javascript:` URi in a Link Target of the link decorator in `decorators/Link/index.js` when a draft is shared across users, leading to XSS.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/react-draft-wysiwyg

Introduced in: 0Fixed in: 1.14.6

Fixnpm install react-draft-wysiwyg@1.14.6

References

https://nvd.nist.gov/vuln/detail/CVE-2021-31712[ADVISORY]
https://github.com/jpuri/react-draft-wysiwyg/issues/1102[WEB]
https://github.com/jpuri/react-draft-wysiwyg/pull/1104[WEB]
https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380[WEB]