Executive brief
Vditor is a browser-based Markdown editor used by developers to create and edit formatted text. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code that executes in the editor if a user copies a crafted payload and pastes it into the document. This could lead to session hijacking, credential theft, or malware distribution among users who interact with compromised content.
Technical details
Vditor versions prior to 3.8.7 contain a reflected XSS vulnerability (CWE-79) in the copy-paste handling mechanism. The vulnerability requires user interaction—specifically, a victim must be tricked into copying a malicious payload and pasting it into the editor—but does not require authentication or special privileges. An attacker can craft a payload delivered via social engineering, phishing, or a compromised website that, once pasted, executes arbitrary JavaScript in the victim's browser context. The attack can affect both the editor user's session and potentially other users on the same site (scope: changed). Version 3.8.7 and later contain a fix for this issue.
Affected products
- Vditor Vditor < 3.8.7
Timeline
- 2021-09-21: disclosed
- 2023-02-21: patched: Version 3.8.7 released