Executive brief
ContentTools is a JavaScript library used to build WYSIWYG (what-you-see-is-what-you-get) HTML editors that allow users to create and edit web content. A cross-site scripting (XSS) vulnerability in the image handler allows attackers to inject malicious JavaScript code through the onload attribute of image tags, potentially compromising user sessions and stealing sensitive data from users who interact with the affected editor.
Technical details
The vulnerability is a Stored or Reflected XSS (CWE-79) in the Image Handler component of ContentTools, where the onload attribute of img tags is not properly sanitized or escaped. An attacker can craft a malicious image tag with JavaScript code in the onload handler, and when this content is processed or displayed through the WYSIWYG editor, the JavaScript executes in the context of a user's browser. The attack requires user interaction (inserting/editing an image with a malicious onload attribute) and network reachability to the application using ContentTools. An authenticated user or unauthenticated attacker (depending on editor access controls) can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, or malware distribution. The vulnerability affects ContentTools up to version 1.6.16; the vendor was contacted but did not respond with a patch.
Affected products
- GetmeUK ContentTools up to 1.6.16
Timeline
- 2025-03-24: disclosed: Vulnerability disclosed publicly; vendor did not respond
- 2025-03-24: advisory: GHSA-4f2v-2gpq-qhjg published