Quick answers
- Is CVE-2021-32855 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-32855 being exploited in the wild.
- How severe is CVE-2021-32855?
- Low severity, with a CVSS score of 3.1, published 21 February 2023.
- Which products and versions are affected?
- vditor (npm) SEMVER:introduced=0,fixed=3.8.7.
- Is there a fix for CVE-2021-32855?
- Yes. vditor (npm): upgrade to 3.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-32855 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-32855?
- Check whether you run vditor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vditor (npm): upgrade to 3.8.7 or later
npm install vditor@3.8.7
Technical details
Vditor versions prior to 3.8.7 contain a reflected XSS vulnerability (CWE-79) in the copy-paste handling mechanism. The vulnerability requires user interaction—specifically, a victim must be tricked into copying a malicious payload and pasting it into the editor—but does not require authentication or special privileges. An attacker can craft a payload delivered via social engineering, phishing, or a compromised website that, once pasted, executes arbitrary JavaScript in the victim's browser context. The attack can affect both the editor user's session and potentially other users on the same site (scope: changed). Version 3.8.7 and later contain a fix for this issue.
Affected products
- Vditor Vditor < 3.8.7
Identifiers
- CVE-2021-32855
- GHSA-vfmp-9999-6wqj
Timeline
- 2021-09-21: disclosed
- 2023-02-21: patched: Version 3.8.7 released