PT-2022-16015 · Editor.Js · Editor.Js

Bananabr + 5 · Published 2022-12-15 · Updated 2024-08-05 · CVE-2022-23474

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Editor.js versions prior to 2.26.0

Description The issue concerns a code injection vulnerability via pasted input in Editor.js, a block-style editor. The processHTML method is vulnerable as it passes pasted input into the wrapper's innerHTML. This allows for potential code injection attacks.

Recommendations For versions prior to 2.26.0, update to version 2.26.0 to resolve the issue. As a temporary workaround, consider disabling the processHTML method until the patch is applied. Restrict access to pasted input to minimize the risk of exploitation.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2022-23474

GHSA-6MVJ-2569-3MCM

Affected Products

Editor.Js

References · 10

• 🔥 https://github.com/codex-team/editor.js/pull/2100 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23474.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js · Exploit
• https://osv.dev/vulnerability/CVE-2022-23474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23474 · Security Note
• https://osv.dev/vulnerability/GHSA-6mvj-2569-3mcm · Vendor Advisory
• https://github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2 · Note
• https://github.com/codex-team/editor.js · Note
• https://securitylab.github.com/advisories · Note
• https://t.me/cibsecurity/54607 · Telegram Post