GHSA-gvpx-9459-w3mjMediumCVSS 6.1

Cross-Site Scripting in @ckeditor/ckeditor5-link

Published
May 23, 2018
Last Modified
May 1, 2023

🔗 CVE IDs covered (1)

CVE-2018-11093 →

📋 Description

Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The _createPreviewButton() function fails to sanitize the href attribute of a created <a> tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 10.0.1 or later.

🎯 Affected products1

  • npm/@ckeditor/ckeditor5-link:>= 0.3.0, < 10.0.1

🔗 References (7)