Executive brief
The Atlaskit editor-core library is a rich text editing component used in Atlassian products and web applications to compose documents and messages. A cross-site scripting (XSS) vulnerability in the hyperlinks feature allows attackers with user account access to inject malicious JavaScript through specially crafted link targets, potentially compromising end-user sessions or stealing sensitive data when users interact with affected links.
Technical details
The vulnerability is a stored or reflected XSS (CWE-79) in the hyperlinks functionality of @atlaskit/editor-core before version 113.1.5, where link targets are not properly sanitized before rendering. An authenticated attacker can inject arbitrary HTML or JavaScript by crafting a malicious link target within the editor interface. The attack requires user interaction (clicking the link) and authenticated access to the editor, but affects all versions prior to 113.1.5. The fix was released in version 113.1.5 as documented in the Atlaskit changelog.
Affected products
- Atlassian Atlaskit editor-core before 113.1.5
Timeline
- 2020-10-01: disclosed: NVD publication date
- 2022-02-10: advisory: GHSA advisory published
- 2021: patched: Fixed in version 113.1.5