Vulnerability · Published Sep 24, 2022 · Assigned by GitHub_M
CVE-2022-23461Cross-Site Scripting (XSS) in Jodit Editor
Medium 5.4
In plain English
A medium-severity cross-site scripting in Jodit Editor from xdan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.6%top 50.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | jodit | no fix listed | GHSA-42hx-vrxx-5r6v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xdan | Jodit Editor | 3.20.4 – through 3.20.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit/ x_refsource_MISC