CVE-2022-23474

editor.js contains Code Injection

CVSS 6.1 MEDIUMEPSS 0.5%CWE-94

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 Dec 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

codex-team · editor.js

References

https://github.com/codex-team/editor.js/pull/2100 https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/