Is CVE-2020-19697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-19697 being exploited in the wild.

How severe is CVE-2020-19697?

Low severity, with a CVSS score of 3.1, published 4 April 2023.

Which products and versions are affected?

editor.md (npm) SEMVER:introduced=0,last_affected=1.5.0.

Is there a fix for CVE-2020-19697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-19697 attacked?

It is attacked over the network.

Am I affected by CVE-2020-19697?

Check whether you run editor.md (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-19697: Pandao Editor.md cross-site scripting in iframe src parameter

CVE-2020-19697 · Severity: low · CVSS 3.1 · Published 2023-04-04

Pandao Editor.md is a popular open-source markdown editor library used in web applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript code through the iframe src attribute, which is then executed in users' browsers. This can lead to theft of cookies, session tokens, and other sensitive data, or enable account takeover and unauthorized actions on behalf of the victim.

Technologies: editor.md (npm). Vendors: npm.

Quick answers

Is CVE-2020-19697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-19697 being exploited in the wild.
How severe is CVE-2020-19697?: Low severity, with a CVSS score of 3.1, published 4 April 2023.
Which products and versions are affected?: editor.md (npm) SEMVER:introduced=0,last_affected=1.5.0.
Is there a fix for CVE-2020-19697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-19697 attacked?: It is attacked over the network.
Am I affected by CVE-2020-19697?: Check whether you run editor.md (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored or reflected cross-site scripting (CWE-79) issue in Editor.md v1.5.0 and earlier versions. The root cause is insufficient input validation on the iframe src parameter, which allows an attacker to inject a JavaScript URI scheme (e.g., `javascript://%0aalert(document.cookie)`) that executes arbitrary code in the user's browser context. The attack requires no authentication but does require user interaction (the user must view the crafted markdown). An attacker can exploit this to execute arbitrary JavaScript, access browser storage, perform actions as the logged-in user, or redirect to malicious sites. The vulnerability has been tracked as CVE-2020-19697 and patch information is available via GitHub pull request #860.

Affected products

Pandao Editor.md 1.5.0 and earlier

Identifiers

CVE-2020-19697
GHSA-w974-rq9x-mh3v

Timeline

2019-07-02: disclosed: Vulnerability reported on GitHub issue #701
2023-04-04: advisory: GHSA-w974-rq9x-mh3v published with CVSS 6.1 (Medium)
2023-04-04: other: CVE-2020-19697 assigned

References

https://github.com/pandao/editor.md/issues/701

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.