Executive brief
Vditor is a popular web-based markdown editor. A stored cross-site scripting (XSS) vulnerability in versions prior to 3.8.13 allows authenticated users to inject malicious JavaScript that persists in the application and executes in the browsers of other users who view the affected content, potentially leading to account hijacking or theft of sensitive information.
Technical details
This is a stored cross-site scripting vulnerability (CWE-79) in vditor prior to version 3.8.13. The vulnerability exists in the editor's handling of user-supplied input, allowing authenticated users to inject malicious JavaScript code that is stored and later executed when other users view the content. The attack requires user interaction (someone viewing the malicious content) and authenticated access to inject the payload. An attacker can steal session tokens, perform actions on behalf of other users, or capture sensitive data. The fix was released in version 3.8.13 as evidenced by commit e912e36ea98251d700499b1ac7702708d3398476.
Affected products
- Vanessa219 vditor prior to 3.8.13
Timeline
- 2022-03-31: disclosed: NVD published
- 2022-04-01: advisory: GitHub Security Advisory GHSA-689x-x68p-fph3 published
- 2022-04-08: patched: Fix released in version 3.8.13