What is GHSA-6mvj-2569-3mcm?

GHSA-6mvj-2569-3mcm is a security advisory published by GitHub Security Advisories with Medium severity. Editor.js vulnerable to Code Injection

Which CVE IDs does GHSA-6mvj-2569-3mcm cover?

GHSA-6mvj-2569-3mcm covers the following CVE IDs: CVE-2022-23474. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6mvj-2569-3mcm?

GHSA-6mvj-2569-3mcm has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6mvj-2569-3mcm?

GHSA-6mvj-2569-3mcm affects 1 product, including: npm/@editorjs/editorjs:\u003c 2.26.0.

GHSA-6mvj-2569-3mcmMediumCVSS 6.1

Editor.js vulnerable to Code Injection

Vendor

GitHub Security Advisories

Published

August 5, 2024

Last Modified

August 5, 2024

🔗 CVE IDs covered (1)

CVE-2022-23474 →

📋 Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

🎯 Affected products1

npm/@editorjs/editorjs:< 2.26.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-23474
https://github.com/codex-team/editor.js/pull/2100
https://github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2
https://securitylab.github.com/advisories
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js
https://github.com/advisories/GHSA-6mvj-2569-3mcm