Executive brief
mobiledoc-kit is a JavaScript library used to build rich-text editors in web applications. A reflected cross-site scripting vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they interact with affected editor instances, potentially compromising user sessions and stealing sensitive data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in mobiledoc-kit prior to version 0.14.2 (CWE-79). The vulnerability allows an attacker to inject arbitrary JavaScript code that executes in a victim's browser when they interact with a malicious editor instance. The attack requires user interaction (such as clicking a link or opening a crafted editor state) but does not require authentication. An attacker can exploit this to steal cookies, session tokens, or perform actions on behalf of the victim. The vulnerability was patched in version 0.14.2, available via npm.
Affected products
- Bustle mobiledoc-kit prior to 0.14.2
Timeline
- 2022-08-23: disclosed
- 2022-08-18: patched: Version 0.14.2 released