Editor.js vulnerable to Code Injection

MEDIUM 6.1CVE-2022-23474 · GHSA-6mvj-2569-3mcm · Published 15/12/2022 · updated 17/06/2026

In short

CVE-2022-23474 is a MEDIUM (CVSS 6.1) vulnerability affecting editor.js (codex), @editorjs/editorjs.
Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.4% of all vulnerabilities.
Fix: update to 2.26.0 or later.

Package	Affected versions	Patched versions
editor.js codex	`< 2.26.0`	`2.26.0`
@editorjs/editorjs npm	`< 2.26.0`	`2.26.0`

Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23474 · ADVISORY
codex-team/editor.js#2100 · WEB
codex-team/editor.js commit f659015 · WEB
codex-team/editor.js · PACKAGE
securitylab.github.com/advisories · WEB
securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js · ADVISORY
securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free