jodit@4.0.0-beta.69

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the safeHTML sanitizer in src/core/helpers/html/safe-html.ts and the clean-html plugin’s value-set/on-change sanitization paths. An attacker can execute a script in a victim’s page by supplying HTML that hides an event-bearing element inside a MathML/<style> rawtext carrier, then relying on a later reparse to hoist it back into a live HTML node. The sanitizer walks the inert parse tree instead of removing the smuggled foreign HTML itself, so editor.value can retain a live <img> or similar element with handlers such as onload or onfocus. When an application renders that stored value, the handler fires without user interaction, leading to XSS in any consumer that trusts the editor output.

Upgrade jodit to version 4.12.28 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can inject unexpected properties into Object.prototype by supplying a crafted chain containing __proto__, constructor, or prototype as path segments.

Upgrade jodit to version 4.12.26 or higher.

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the rich text editor component, allowing an attacker to obtain sensitive information by sending a specially crafted payload.

There is no fixed version for jodit.