Executive brief
Froala WYSIWYG editor is a JavaScript-based content editor used in web applications to allow users to create and format HTML content. An inconsistent tag parsing flaw allows attackers to inject malicious scripts that execute in a user's browser when they interact with specially crafted HTML content, potentially compromising user data and enabling account takeover.
Technical details
The vulnerability stems from inconsistent tag parsing in the Froala WYSIWYG editor that fails to properly sanitize HTML input, resulting in a reflected XSS (CWE-79). The root cause involves how the editor handles certain HTML tag structures, allowing attackers to bypass content filtering mechanisms. The attack vector is network-based and requires user interaction (UI:R)—specifically, a user must open or interact with content containing the malicious payload within the editor. No authentication is required. An attacker can inject arbitrary JavaScript that executes with the privileges of the victim's session, potentially stealing session tokens, modifying page content, or performing actions on behalf of the user. Patches are available in versions after 4.3.0.
Affected products
- Froala WYSIWYG Editor 4.3.0 and earlier (npm: froala-editor all versions up to 4.3.0; Composer: froala/wysiwyg-editor v2.x, v3.x, v4.x up to v4.3.0)
Timeline
- 2024-11-07: disclosed: NVD publication date
- 2024-11-08: advisory: GHSA-549p-5c7f-c5p4 published
- 2025-03-14: other: Advisory last modified/reviewed