# CVE-2023-41592: Froala Editor cross-site scripting vulnerability

Source: https://junglewise.ai/threats/cve-2023-41592-froala-editor-cross-site-scripting-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-41592 · Severity: low · CVSS 3.1 · Published 2023-09-15

Froala Editor is a rich-text document editor used in web applications to allow users to create and format content. Versions 4.0.1 through 4.1.3 contain a cross-site scripting (XSS) vulnerability that allows attackers with editor access to inject malicious scripts that execute in other users' browsers, potentially compromising account credentials, stealing session tokens, or defacing content.

Technologies: [Froala Editor](https://junglewise.ai/threats/technologies/editor), [froala-editor (npm)](https://junglewise.ai/threats/technologies/froala-editor), [froala/wysiwyg-editor (Packagist)](https://junglewise.ai/threats/technologies/froala-wysiwyg-editor). Vendors: [Froala](https://junglewise.ai/threats/vendors/froala), [npm](https://junglewise.ai/threats/vendors/npm), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-41592 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-41592 being exploited in the wild.

**How severe is CVE-2023-41592?** Low severity, with a CVSS score of 3.1, published 15 September 2023.

**Which products and versions are affected?** Froala Editor 4.0.1 to 4.1.3; froala-editor (npm) SEMVER:introduced=4.0.1,fixed=4.1.4; froala/wysiwyg-editor (Packagist) ECOSYSTEM:introduced=4.0.1,fixed=4.1.4.

**Is there a fix for CVE-2023-41592?** Yes. froala-editor (npm): upgrade to 4.1.4 or later; froala/wysiwyg-editor (Packagist): upgrade to 4.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-41592 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-41592?** Check whether you run Froala Editor, froala-editor (npm) or froala/wysiwyg-editor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- froala-editor (npm): upgrade to 4.1.4 or later

  ```sh
  npm install froala-editor@4.1.4
  ```

- froala/wysiwyg-editor (Packagist): upgrade to 4.1.4 or later

  ```sh
  composer require froala/wysiwyg-editor:^4.1.4
  ```


## Technical details

This is a stored cross-site scripting (XSS) vulnerability in Froala Editor versions 4.0.1 to 4.1.3, classified as CWE-79. The vulnerability allows an authenticated or privileged user to inject malicious JavaScript through the editor interface that persists when the content is viewed by other users. Attack requires user interaction (opening the edited content) and authentication to use the editor, but impact spans across sessions (C:L, I:L per CVSS 3.1). The vulnerability was patched in version 4.1.4.

## Affected products

- Froala Editor 4.0.1 to 4.1.3

## Identifiers

- CVE-2023-41592
- GHSA-hvpq-7vcc-5hj5

## Timeline

- 2023-09-14: disclosed: CVE-2023-41592 published
- 2023: patched: Fixed in version 4.1.4

## References

- [https://github.com/froala/wysiwyg-editor/issues/4612](https://github.com/froala/wysiwyg-editor/issues/4612)

## Related threats

- [Froala WYSIWYG editor XSS in tag parsing](https://junglewise.ai/threats/cve-2024-51434-froala-wysiwyg-editor-xss-in-tag-parsing)
- [Froala WYSIWYG Editor XSS Vulnerability](https://junglewise.ai/threats/cve-2020-26523-froala-wysiwyg-editor-xss-vulnerability)
- [Froala Editor DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2019-19935-froala-editor-dom-based-cross-site-scripting)
- [Froala WYSIWYG Editor cross-site scripting in video insertion](https://junglewise.ai/threats/cve-2020-22864-froala-wysiwyg-editor-cross-site-scripting-in-video-insertion)
- [Froala Editor cross-site scripting in hyperlink creation](https://junglewise.ai/threats/cve-2021-30109-froala-editor-cross-site-scripting-in-hyperlink-creation)