Cross-Site Scripting in simditor

MEDIO 6.1CVE-2018-19048 · GHSA-8v67-x8q5-3x3g · Published 13/05/2019 · updated 17/06/2026

In breve

CVE-2018-19048 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda simditor (mycolorway), simditor.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 75.0% delle vulnerabilità.
Correzione: aggiornare a 2.3.22 o successiva.

Package	Affected versions	Patched versions
simditor mycolorway	`≤ 2.3.21`	No fix yet
simditor npm	`< 2.3.22`	`2.3.22`

Description

Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 2.3.22 or later.

NVD description

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.

References

nvd.nist.gov/vuln/detail/CVE-2018-19048 · ADVISORY
mycolorway/simditor commit ef01a64 · WEB
hkglue/simditor_demo.git · WEB
hkglue/simditor_dom_xss · WEB
mycolorway/simditor release v2.3.22 · WEB
snyk.io/vuln/SNYK-JS-SIMDITOR-174638 · WEB
npmjs.com/advisories/884 · WEB

Altre vulnerabilità di simditor

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free