Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05aGZ3LWN2ZjQtNXgyNc4AA8lJ

wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function

There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12.

Permalink: https://github.com/advisories/GHSA-9hfw-cvf4-5x25
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aGZ3LWN2ZjQtNXgyNc4AA8lJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 6 months ago


Identifiers: GHSA-9hfw-cvf4-5x25, CVE-2022-25037
References: Repository: https://github.com/wangeditor-team/wangEditor
Blast Radius: 0.0

Affected Packages

npm:@wangeditor/editor
Dependent packages: 374
Dependent repositories: 738
Downloads: 67,108 last month
Affected Version Ranges: <= 4.7.11
Fixed in: 4.7.12
All affected versions: 0.9.0, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.11.0, 0.12.0, 0.12.1, 0.12.2, 0.12.3, 0.12.4, 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.12.11, 0.13.0, 0.13.1, 0.13.2, 0.13.3, 0.13.4, 0.13.5, 0.13.6, 0.13.7, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.15.0, 0.15.1, 0.15.2, 0.15.3, 0.15.4, 0.15.5, 0.15.6, 0.15.7, 0.15.8, 0.15.9, 0.15.10, 0.15.11, 0.15.12, 0.15.13, 0.15.14, 0.15.15, 0.15.16, 0.15.17, 0.15.18, 0.15.19, 0.15.20
All unaffected versions: 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.1.14, 5.1.15, 5.1.16, 5.1.17, 5.1.18, 5.1.19, 5.1.20, 5.1.21, 5.1.22, 5.1.23