GHSA-8v67-x8q5-3x3gMediumCVSS 6.1

Cross-Site Scripting in simditor

Published
May 14, 2019
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-19048 →

📋 Description

Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 2.3.22 or later.

🎯 Affected products1

  • npm/simditor:< 2.3.22

🔗 References (8)