GHSA-cr56-66mx-293vHighDisclosed before NVD

Cross-Site Scripting in @toast-ui/editor

Published
September 3, 2020
Last Modified
April 3, 2023

📋 Description

Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.

Recommendation

Upgrade to version 2.2.0 or later.

🎯 Affected products1

  • npm/@toast-ui/editor:< 2.2.0

🔗 References (5)