Executive brief
mavon-editor is a popular markdown editor component used in web applications. The package fails to properly sanitize user input, allowing attackers to inject and execute malicious JavaScript code in the browsers of users viewing affected content. This can lead to theft of user sessions, account takeover, or defacement of the application interface.
Technical details
The vulnerability is a stored/reflected Cross-Site Scripting (XSS) flaw (CWE-79) affecting all versions of mavon-editor prior to 2.8.2. The package does not sanitize user-supplied input before rendering it in the markdown editor interface, allowing attackers to inject arbitrary JavaScript. The attack requires user interaction (visiting a page containing the malicious markdown), but no authentication is needed. An attacker can execute arbitrary JavaScript in a victim's browser within the security context of the affected application. A fix was merged in PR #548 and is available in version 2.8.2 and later.
Affected products
- mavon-editor mavon-editor < 2.8.2
Timeline
- 2020-09-03: disclosed
- 2020-04-01: patched: Fix merged in PR #548