Homepage

Cross-site Scripting (XSS) Affecting summernote package, versions <0.8.19

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-SUMMERNOTE-597187
  • published9 Oct 2020
  • disclosed3 Aug 2020
  • creditAlejandroid17
Report a new vulnerability Found a mistake?

Introduced: 3 Aug 2020

CVE-2024-29504  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade summernote to version 0.8.19 or higher.

Overview

summernote is a super simple WYSIWYG Editor.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It is possible to inject malicious JavaScript within the myforms area due to no sanitization.

PoC

from crispy_forms.helper import FormHelper
from crispy_forms.layout import Submit, Column, Row, Layout
from django.forms import HiddenInput
from django.utils.translation import ugettext as _
from django import forms
from django_summernote.widgets import SummernoteInplaceWidget


from myapp.models import MyModel


class MyForm(forms.ModelForm):


def __init__(self, *args, **kwargs):
    super(MyForm, self).__init__(*args, **kwargs)
    self.helper = FormHelper()
    self.helper.layout = Layout(
        Row(Column(&#39;title&#39;, css_class=&#39;form-group col-md-6&#39;), css_class=&#39;form-row&#39;),
        Row(Column(&#39;base_template&#39;, css_class=&#39;form-group col-md-12&#39;), css_class=&#39;form-row&#39;),
        Row(Column(&#39;base_css_template&#39;, css_class=&#39;form-group col-md-6&#39;, ), css_class=&#39;form-row&#39;),
        &#39;doc&#39;,
        Submit(&#39;submit&#39;, _(&#39;Save&#39;))
    )

class Meta:
    model = MyModel
    fields = &#39;__all__&#39;
    widgets = {
        &#39;base_template&#39;: SummernoteInplaceWidget(attrs={&#39;summernote&#39;: {&#39;width&#39;: &#39;100%&#39;, &#39;height&#39;: &#39;600px&#39;}}),
        &#39;document_type&#39;: HiddenInput()
    }
    labels = {
        &#39;title&#39;: _(&#39;Title&#39;),
        &#39;base_template&#39;: _(&#39;Body&#39;),
        &#39;base_css_template&#39;: _(&#39;CSS stylesheet (optional)&#39;),
        &#39;doc&#39;: _(&#39;Doc&#39;),
    }

CVSS Scores

version 3.1