summernote@0.8.5 vulnerabilities

summernote is a super simple WYSIWYG Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the createLink function in the Editor class. An attacker can execute arbitrary code by injecting a crafted script.

Note:

This is only exploitable if the attacker can access the editor component.

Upgrade summernote to version 0.9.0 or higher.

summernote is a super simple WYSIWYG Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It is possible to inject malicious JavaScript within the myforms area due to no sanitization.

PoC

from crispy_forms.helper import FormHelper
from crispy_forms.layout import Submit, Column, Row, Layout
from django.forms import HiddenInput
from django.utils.translation import ugettext as _
from django import forms
from django_summernote.widgets import SummernoteInplaceWidget

from myapp.models import MyModel


class MyForm(forms.ModelForm):

    def __init__(self, *args, **kwargs):
        super(MyForm, self).__init__(*args, **kwargs)
        self.helper = FormHelper()
        self.helper.layout = Layout(
            Row(Column('title', css_class='form-group col-md-6'), css_class='form-row'),
            Row(Column('base_template', css_class='form-group col-md-12'), css_class='form-row'),
            Row(Column('base_css_template', css_class='form-group col-md-6', ), css_class='form-row'),
            'doc',
            Submit('submit', _('Save'))
        )

    class Meta:
        model = MyModel
        fields = '__all__'
        widgets = {
            'base_template': SummernoteInplaceWidget(attrs={'summernote': {'width': '100%', 'height': '600px'}}),
            'document_type': HiddenInput()
        }
        labels = {
            'title': _('Title'),
            'base_template': _('Body'),
            'base_css_template': _('CSS stylesheet (optional)'),
            'doc': _('Doc'),
        }

Upgrade summernote to version 0.8.19 or higher.