Executive brief
editor.md is a popular open-source markdown editor used in web applications. A cross-site scripting vulnerability allows attackers to inject malicious JavaScript code that executes in users' browsers when they interact with the editor. This can lead to account hijacking, cookie theft, and unauthorized actions performed on behalf of the user.
Technical details
The vulnerability is a stored or reflected cross-site scripting (CWE-79) flaw in pandao editor.md 1.5.0. The editor fails to properly sanitize and escape input containing the JavaScript protocol handler (javascript: URLs), allowing an attacker to embed malicious scripts that execute when the content is rendered. The attack requires minimal preconditions—an attacker can inject the payload through the editor's input, and it will execute when viewed in a user's browser with typical user interaction (UI required). A successful exploit grants the attacker access to the victim's session cookies and DOM context. The vulnerability affects npm package editor.md versions 1.* up to at least 1.5.0; a fix should involve implementing strict input validation and output encoding for protocol handlers.
Affected products
- pandao editor.md 1.5.0
Timeline
- 2019-07-22: disclosed: XSS vulnerability reported as issue #709 on GitHub
- 2019-08-23: advisory: GHSA-5q54-8p9j-x74j published