Executive brief
Editor.js is a popular open-source rich text editor used to create and format document content. Versions before 2.26.0 allow attackers to inject malicious code through pasted content, which is then executed in the browser, potentially compromising user accounts or stealing sensitive data displayed in the editor. The vulnerability requires user interaction (pasting content) but affects any application using the vulnerable library.
Technical details
The vulnerability is a code injection flaw (CWE-79 Cross-site Scripting and CWE-94 Improper Control of Generation of Code) in Editor.js's processHTML method, which passes user-pasted input directly into the DOM via innerHTML without proper sanitization. An attacker can craft malicious HTML/JavaScript payloads and trick a user into pasting them; the code executes in the context of the application using Editor.js. The attack requires user interaction (paste action) and network reachability if the application is web-based. The vulnerability is patched in version 2.26.0, which adds a sanitize configuration option to the pasteConfig.tags feature.
Affected products
- Codex Team Editor.js before 2.26.0
Timeline
- 2022-12-15: disclosed
- 2022-11-21: patched: Fix merged in PR #2100