Описание
Cross-Site Scripting in @toast-ui/editor
Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.
Recommendation
Upgrade to version 2.2.0 or later.
Пакеты
Наименование
@toast-ui/editor
npm
Затронутые версииВерсия исправления
< 2.2.0
2.2.0
Дефекты
CWE-79
Дефекты
CWE-79