wangfupeng1988/wangeditor · Security
Cross-Site Scripting in wangeditor
- GHSA ID
- GHSA-g7mw-5cq6-fv82
- Severity
- high
- Published
- Updated
Description
All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')