Description

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.

Remediation

References

https://github.com/pandao/editor.md/issues/715

Related Vulnerabilities

CVE-2020-26296 Vulnerability in maven package org.webjars.bowergithub.vega:vega

CVE-2022-39382 Vulnerability in npm package @keystone-6/core

CVE-2020-8203 Vulnerability in maven package org.webjars.bower:lodash

CVE-2022-45143 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2021-4264 Vulnerability in npm package dustjs-linkedin

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory