Vulnerability · Published Dec 15, 2022 · Assigned by GitHub_M
CVE-2022-23474editor.js contains Code Injection
Medium 6.1
In plain English
A medium-severity code injection in editor.js from codex-team. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @editorjs/editorjs | 2.26.0 | GHSA-6mvj-2569-3mcm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codex-team | editor.js | 2.26.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/ x_refsource_CONFIRM
- https://github.com/codex-team/editor.js/pull/2100 x_refsource_MISC