Executive brief
React Draft Wysiwyg is a rich-text editor library used in web applications to allow users to create and edit formatted content. The library fails to validate JavaScript protocol URLs in link targets, allowing an attacker to inject malicious links into shared drafts that execute arbitrary JavaScript in the context of other users' browsers when clicked.
Technical details
React Draft Wysiwyg before version 1.14.6 contains a cross-site scripting (XSS) vulnerability in the link decorator component (decorators/Link/index.js). The vulnerability exists because the library does not filter or validate the javascript: protocol prefix when processing link targets, allowing attackers to craft malicious links. When a draft containing a javascript: URL is shared among users and clicked, the window.open() function executes the embedded JavaScript payload directly in the victim's browser. The attack requires user interaction (clicking the link) and is amplified in collaborative editing scenarios where drafts are shared across multiple users. The fix is available in version 1.14.6 and later.
Affected products
- React Draft Wysiwyg React Draft Wysiwyg before 1.14.6
Timeline
- 2021-04-14: disclosed: Issue opened on GitHub
- 2021-04-24: advisory: CVE-2021-31712 published by NVD
- 2021-05-06: patched: Fix released in version 1.14.6; GHSA advisory published