telerik/kendo-angular-editor · Security
Cross-Site Scripting in @progress/kendo-angular-editor
- GHSA ID
- GHSA-j7wp-vjj6-cp5m
- Severity
- high
- Published
- Updated
Description
Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.
Adding the following content to the Editor value demonstrates the issue: <img src="" onerror=alert(document.domain)>.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')