Executive brief
wangEditor is a popular open-source rich text editor used in web applications to allow users to create and format content. The editor fails to properly encode JavaScript code in links, allowing attackers to inject malicious scripts that execute when other users view the affected content. This can lead to session hijacking, credential theft, or defacement of web applications using the editor.
Technical details
wangEditor contains a cross-site scripting (CWE-79) vulnerability stemming from improper output encoding of link content. The vulnerability allows arbitrary JavaScript to be inserted into hyperlinks and executed in users' browsers when the links are clicked or viewed. No special authentication or user interaction beyond normal editor usage is required to create malicious content. All versions of wangEditor are affected. No fix has been made available as of the advisory publication date; users are advised to consider alternative editors or implement additional input sanitization at the application level.
Affected products
- wangeditor-team wangEditor
Timeline
- 2020-09-02: disclosed