GHSA-m5jf-8crm-r65m

Source

https://github.com/advisories/GHSA-m5jf-8crm-r65m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m5jf-8crm-r65m/GHSA-m5jf-8crm-r65m.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-m5jf-8crm-r65m

Aliases

CVE-2024-34449

Published

2024-05-03T18:30:37Z

Modified

2024-05-03T20:56:35.060068Z

Summary

Vditor allows Cross-site Scripting via an attribute of an `A` element

Details

Vditor 3.10.3 allows XSS via an attribute of an A element.

NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

Database specific

{
    "nvd_published_at": "2024-05-03T16:15:11Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-03T20:38:15Z"
}

References

Affected packages

npm / vditor

Package

Name: vditor; View open source insights on deps.dev
Purl: pkg:npm/vditor

Affected ranges

Affected versions

3.*

3.10.3