Executive brief
EpicEditor is a JavaScript-based Markdown editor component used in web applications to allow users to write and preview formatted content. The editor fails to sanitize user-supplied markdown before rendering it to HTML, allowing attackers to inject malicious scripts that execute in victims' browsers when previewing content. This can lead to session hijacking, credential theft, or malware distribution through compromised editor instances.
Technical details
EpicEditor uses marked.js to convert Markdown input to HTML for preview rendering but leaves the default marked.js option `sanitize: false`, which disables HTML sanitization. An attacker can embed HTML event handlers (e.g., `<img src=0 onerror="alert(1)">`) in Markdown content; when a user previews the content in EpicEditor, the arbitrary JavaScript executes in their browser with full access to the page context (CWE-79). The vulnerability requires user interaction (viewing a preview) but no authentication. The attack vector is network-based if the application embeds EpicEditor and accepts user-supplied markdown. A fix is to enable sanitization by setting `marked.setOptions({sanitize: true})` or configuring marked.defaults with `sanitize: true`. The project is currently deprecated and no longer actively maintained.
Affected products
- Oscar Godson EpicEditor through 0.2.3
Timeline
- 2017-03-09: disclosed
- 2022-05-17: advisory: GHSA-4wc5-gfgh-4vjx published in GitHub Advisory Database