GHSA-cxm3-v4mv-6mh8MediumCVSS 5.4

vditor Vulnerable to Cross-site Scripting in SVG events

Published
January 28, 2022
Last Modified
September 12, 2023

🔗 CVE IDs covered (1)

CVE-2021-4103 →

📋 Description

vditor does not filter user input in SVG events, leading to XSS

PoC

</a>
<svg><animate onbegin=alert(11) attributeName=x dur=1s>

🎯 Affected products1

  • npm/vditor:< 3.8.11

🔗 References (5)