Vditor allows Cross-site Scripting via an attribute of an `A` element

보통 6.1CVE-2024-34449 · GHSA-m5jf-8crm-r65m · Published 03/05/2024 · updated 17/06/2026

요약

Package	Affected versions	Patched versions
vditor b3log	`= 3.10.3`	No fix yet
vditor npm	`= 3.10.3`	No fix yet

Vditor 3.10.3 allows XSS via an attribute of an A element.

NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

NVD description

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

= 3.10.3

No fix yet

npm

= 3.10.3

No fix yet

Description

Vditor 3.10.3 allows XSS via an attribute of an A element.

NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

NVD description

Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.

vditor의 다른 취약점

모두 보기 →