Executive brief
Pandao editor.md is a popular JavaScript markdown editor library used by web developers to enable rich text editing in web applications. A DOM-based cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript code through specially crafted markdown input, which can lead to session hijacking, credential theft, or execution of arbitrary actions on behalf of users who view the rendered content.
Technical details
The vulnerability is a DOM-based XSS (CWE-79) in editor.md version 1.5.0, triggered by markdown input starting with the "<<" substring. The vulnerability occurs during construction of anchor (<a>) elements from markdown link syntax; insufficient input validation allows attackers to inject malicious JavaScript via the href attribute (e.g., "javascript:" URLs). The attack vector is network-based and requires no authentication, but does require user interaction (rendering and clicking the malicious link). An attacker can craft markdown content with JavaScript URIs that executes when a victim clicks the generated link. A patch or updated version may be available from the project repository.
Affected products
- Pandao editor.md 1.5.0
Timeline
- 2018-11-07: disclosed
- 2018-11-09: advisory