# CVE-2021-4103: vditor cross-site scripting in SVG events

Source: https://junglewise.ai/threats/cve-2021-4103-vditor-cross-site-scripting-in-svg-events  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-4103 · Severity: low · CVSS 3.1 · Published 2022-01-28

vditor is a popular open-source Markdown editor used in web applications. The vulnerability allows attackers to inject malicious JavaScript code through SVG event attributes, which are not properly sanitized. If an application using vditor processes untrusted user input, an attacker can execute arbitrary JavaScript in the context of other users' browsers, leading to account compromise, data theft, or malware delivery.

Technologies: [vditor (npm)](https://junglewise.ai/threats/technologies/vditor). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-4103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-4103 being exploited in the wild.

**How severe is CVE-2021-4103?** Low severity, with a CVSS score of 3.1, published 28 January 2022.

**Which products and versions are affected?** vditor (npm) SEMVER:introduced=0,fixed=3.8.11.

**Is there a fix for CVE-2021-4103?** Yes. vditor (npm): upgrade to 3.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-4103 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-4103?** Check whether you run vditor (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vditor (npm): upgrade to 3.8.11 or later

  ```sh
  npm install vditor@3.8.11
  ```


## Technical details

vditor fails to sanitize event attributes in SVG elements, specifically allowing `onbegin` and similar event handlers in SVG tags. The vulnerability is a classic reflected/stored cross-site scripting (XSS) flaw (CWE-79) that requires user interaction to trigger—typically when a victim views or interacts with content containing the malicious SVG. An attacker can craft a payload like `<svg><animate onbegin=alert(11) attributeName=x dur=1s>` and inject it through the editor. The attack vector is network-based with low attack complexity, though it requires authenticated user context and user interaction. The vulnerability was patched in version 3.8.11; all versions prior to this are affected.

## Affected products

- Vanessa219 vditor before 3.8.11

## Identifiers

- CVE-2021-4103
- GHSA-cxm3-v4mv-6mh8

## Timeline

- 2021-12-12: disclosed: Issue reported on huntr.dev
- 2022-01-23: advisory: CVE-2021-4103 published by NVD
- 2022-01-28: patched: GHSA advisory published; fix available in version 3.8.11

## References

- [https://github.com/Vanessa219/vditor/issues/1133](https://github.com/Vanessa219/vditor/issues/1133)

## Related threats

- [Vditor Cross-site Scripting in anchor element attributes](https://junglewise.ai/threats/cve-2024-34449-vditor-cross-site-scripting-in-anchor-element-attributes)
- [Vditor cross-site scripting in copy-paste](https://junglewise.ai/threats/cve-2021-32855-vditor-cross-site-scripting-in-copy-paste)
- [Vditor stored cross-site scripting](https://junglewise.ai/threats/cve-2022-0350-vditor-stored-cross-site-scripting)
- [vditor cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2022-0341-vditor-cross-site-scripting-vulnerability)