@editorjs/editorjs@2.25.0 vulnerabilities

Editor.js — open source block-style WYSIWYG editor with JSON output

latest version

2.30.7
latest non vulnerable version

2.31.0-rc.5
first published

6 years ago
latest version published

11 days ago
licenses detected
- Apache-2.0
  >=0
View @editorjs/editorjs package health on Snyk Advisor Open this link in a new tab

Known vulnerabilities in the @editorjs/editorjs package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M Arbitrary Code Injection @editorjs/editorjs is an Editor.js — Native JS, based on API and Open Source Affected versions of this package are vulnerable to Arbitrary Code Injection via pasted input. The `processHTML` method passes pasted input into wrapper’s `innerHTML`. How to fix Arbitrary Code Injection? Upgrade `@editorjs/editorjs` to version 2.26.0 or higher.	<2.26.0