Description
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
Remediation
References
https://github.com/sparksuite/simplemde-markdown-editor/issues/721
Related Vulnerabilities
CVE-2021-23702 Vulnerability in npm package object-extend
CVE-2014-1216 Vulnerability in maven package org.fitnesse:fitnesse
CVE-2022-43415 Vulnerability in maven package org.jenkins-ci.plugins:repo
CVE-2022-22965 Vulnerability in maven package org.springframework:spring-beans
CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.validation