Is CVE-2022-23461 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23461 being exploited in the wild.

How severe is CVE-2022-23461?

Low severity, with a CVSS score of 3.1, published 25 September 2022.

Which products and versions are affected?

jodit (npm) SEMVER:introduced=0,last_affected=3.24.2.

Is there a fix for CVE-2022-23461?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-23461 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-23461?

Check whether you run jodit (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23461: Jodit Editor cross-site scripting in paste handling

CVE-2022-23461 · Severity: low · CVSS 3.1 · Published 2022-09-25

Jodit is a popular rich-text editor (WYSIWYG) embedded in web applications to allow users to compose and format content. The editor fails to properly sanitize maliciously crafted HTML when users paste content, allowing attackers to inject and execute arbitrary JavaScript code. An attacker can exploit this by tricking users into pasting crafted content from a malicious source, potentially stealing session credentials, injecting malware, or defacing the application.

Technologies: jodit (npm). Vendors: npm.

Quick answers

Is CVE-2022-23461 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23461 being exploited in the wild.
How severe is CVE-2022-23461?: Low severity, with a CVSS score of 3.1, published 25 September 2022.
Which products and versions are affected?: jodit (npm) SEMVER:introduced=0,last_affected=3.24.2.
Is there a fix for CVE-2022-23461?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-23461 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-23461?: Check whether you run jodit (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Jodit Editor contains a cross-site scripting (CWE-79) vulnerability in its paste handling logic. The vulnerability arises from incomplete sanitization of HTML input when users paste content, allowing specially crafted payloads to bypass custom sanitization functions. The attack vector is user interaction—users must paste attacker-controlled content into the editor; no network-level attack or privilege escalation is required. A proof-of-concept demonstrates that pasting HTML containing attributes like `onerror="alert(123)"` on an `<img>` tag results in arbitrary JavaScript execution. The issue was reported in May 2022 but remains unpatched as of the advisory publication; the maintainer's custom sanitization functions have proven insufficient against bypass techniques. Users should update to patched versions beyond 3.24.2 when available.

Affected products

xdan jodit all versions up to and including 3.24.2

Identifiers

CVE-2022-23461
GHSA-42hx-vrxx-5r6v

Timeline

2022-05-12: disclosed: vulnerability reported to maintainer
2022-09-25: advisory: GHSA-42hx-vrxx-5r6v and CVE-2022-23461 published
2022-09-24: other: CVE-2022-23461 assigned (NVD published)

References

https://github.com/xdan/jodit

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.