Executive brief
vditor is a popular open-source markdown editor library used in web applications to allow users to create and edit rich content. A cross-site scripting (XSS) vulnerability in vditor versions prior to 3.8.11 allows attackers with authenticated access to inject malicious scripts that could steal user data, hijack sessions, or perform unauthorized actions within the affected application.
Technical details
The vulnerability is a stored/reflected cross-site scripting (CWE-79) flaw in vditor prior to version 3.8.11. The root cause involves improper sanitization of user-supplied input when processing certain HTML strings (particularly table elements like `<Table></Table>`) in the WYSIWYG editor mode via the `insertValue()` method. The attack requires user interaction and authenticated access (as indicated by the CVSS vector PR:L). An attacker can inject malicious JavaScript code that executes in the context of the vulnerable web application. The vulnerability was fixed in version 3.8.11, available via the npm package repository.
Affected products
- vditor vditor prior to 3.8.11
Timeline
- 2022-03-15: disclosed: CVE-2022-0341 published
- 2022-03-15: patched: Version 3.8.11 released with fix