CVE-2022-23474

editor.js contains Code Injection

CVSS 6.1 MEDIUMEPSS 0.5%CWE-94

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

15 dic 2022Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Productos afectados

codex-team · editor.js

Referencias

https://github.com/codex-team/editor.js/pull/2100 https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/