medium5.4
CVE-2022-25037
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function
Impact
There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @wangeditor/editor | <= 4.7.11 | 4.7.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/Mdxjj/5cf0a31e8abf24ed688ceb5b3543516d
- https://github.com/wangeditor-team/wangEditor/issues/3870
- https://github.com/advisories/GHSA-9hfw-cvf4-5x25
- https://nvd.nist.gov/vuln/detail/CVE-2022-25037
- https://github.com/wangeditor-team/wangEditor/issues/3872
- https://github.com/wangeditor-team/wangEditor/commit/6257a2e166346913c34ac5cfb31b6a46e9544c5a