Summernote vulnerable to cross-site scripting

ALTO 7.6CVE-2024-29504 · GHSA-4wh3-3wf2-39m9 · Published 10/04/2024 · updated 17/06/2026

En resumen

CVE-2024-29504 es una vulnerabilidad ALTO (CVSS 7.6) que afecta a summernote (summernote), summernote.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.66%, mayor que el 52.0% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
summernote summernote	`≤ 0.8.18`	No fix yet
summernote npm	`≤ 0.8.18`	No fix yet

Description

Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.

NVD description

Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.

References

nvd.nist.gov/vuln/detail/CVE-2024-29504 · ADVISORY
summernote/summernote#3782 · WEB
gist.github.com/phoenix118go/a9192281efcfa518daa709ab7638712b · WEB
summernote/summernote · PACKAGE

Más vulnerabilidades de summernote

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free