| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor 5-link | < 10.0.1 | 10.0.1 |
| @ckeditor/ckeditor5-link | ≥ 0.3.0, < 10.0.1 | 10.0.1 |
Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The _createPreviewButton() function fails to sanitize the href attribute of a created <a> tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Upgrade to version 10.0.1 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free