vanessa219/vditor · Security
Vditor allows Cross-site Scripting via an attribute of an `A` element
- GHSA ID
- GHSA-m5jf-8crm-r65m
- CVE ID
- CVE-2024-34449
- Severity
- medium
- Published
- Updated
Description
Vditor 3.10.3 allows XSS via an attribute of an A element.
NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')