Is CVE-2021-4103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-4103 being exploited in the wild.

How severe is CVE-2021-4103?

Low severity, with a CVSS score of 3.1, published 28 January 2022.

Which products and versions are affected?

vditor (npm) SEMVER:introduced=0,fixed=3.8.11.

Is there a fix for CVE-2021-4103?

Yes. vditor (npm): upgrade to 3.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-4103 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-4103?

Check whether you run vditor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-4103: vditor cross-site scripting in SVG events

CVE-2021-4103 · Severity: low · CVSS 3.1 · Published 2022-01-28

vditor is a popular open-source Markdown editor used in web applications. The vulnerability allows attackers to inject malicious JavaScript code through SVG event attributes, which are not properly sanitized. If an application using vditor processes untrusted user input, an attacker can execute arbitrary JavaScript in the context of other users' browsers, leading to account compromise, data theft, or malware delivery.

Technologies: vditor (npm). Vendors: npm.

Quick answers

Is CVE-2021-4103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-4103 being exploited in the wild.
How severe is CVE-2021-4103?: Low severity, with a CVSS score of 3.1, published 28 January 2022.
Which products and versions are affected?: vditor (npm) SEMVER:introduced=0,fixed=3.8.11.
Is there a fix for CVE-2021-4103?: Yes. vditor (npm): upgrade to 3.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-4103 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-4103?: Check whether you run vditor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vditor (npm): upgrade to 3.8.11 or later
```
npm install vditor@3.8.11
```

Technical details

vditor fails to sanitize event attributes in SVG elements, specifically allowing `onbegin` and similar event handlers in SVG tags. The vulnerability is a classic reflected/stored cross-site scripting (XSS) flaw (CWE-79) that requires user interaction to trigger—typically when a victim views or interacts with content containing the malicious SVG. An attacker can craft a payload like `<svg><animate onbegin=alert(11) attributeName=x dur=1s>` and inject it through the editor. The attack vector is network-based with low attack complexity, though it requires authenticated user context and user interaction. The vulnerability was patched in version 3.8.11; all versions prior to this are affected.

Affected products

Vanessa219 vditor before 3.8.11

Identifiers

CVE-2021-4103
GHSA-cxm3-v4mv-6mh8

Timeline

2021-12-12: disclosed: Issue reported on huntr.dev
2022-01-23: advisory: CVE-2021-4103 published by NVD
2022-01-28: patched: GHSA advisory published; fix available in version 3.8.11

References

https://github.com/Vanessa219/vditor/issues/1133

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.