Executive brief
React Draft Wysiwyg is a popular rich-text editor component used in web applications to allow users to format and edit content. The embedded button feature fails to properly validate URLs, allowing attackers to inject arbitrary JavaScript code that executes in the context of the application, potentially exposing user sessions and enabling data theft or unauthorized actions.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in the embedded button handler of react-draft-wysiwyg. The vulnerability exists because the component does not validate or filter URL schemes when processing links submitted via the embed button interface; it accepts javascript: protocol URIs and other malicious schemes without restriction. An attacker can craft a malicious link (e.g., javascript:alert('XSS')) and insert it through the Editor's embedded button, which then executes in the browser context when rendered. The payload is persisted to storage or database when saved. Attack requires user interaction to click the embedded button and input the malicious URL. All versions up to 1.15.0 are affected. A patch should implement strict URL scheme validation to allow only http: and https: protocols.
Affected products
- JPuri React Draft Wysiwyg up to 1.15.0
Timeline
- 2025-04-04: disclosed
- 2025-04-04: advisory: GHSA-fq5x-7292-2p5r published on GitHub Advisory Database