Summernote vulnerable to cross-site scripting

ALTO 7.6CVE-2024-29504 · GHSA-4wh3-3wf2-39m9 · Published 10/04/2024 · updated 17/06/2026

Em resumo

CVE-2024-29504 é uma vulnerabilidade ALTO (CVSS 7.6) que afeta summernote (summernote), summernote.
Chance de exploração nos próximos 30 dias (EPSS): 0.66%, maior que 52.0% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
summernote summernote	`≤ 0.8.18`	No fix yet
summernote npm	`≤ 0.8.18`	No fix yet

Description

Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.

NVD description

Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.

References

nvd.nist.gov/vuln/detail/CVE-2024-29504 · ADVISORY
summernote/summernote#3782 · WEB
gist.github.com/phoenix118go/a9192281efcfa518daa709ab7638712b · WEB
summernote/summernote · PACKAGE

Mais vulnerabilidades de summernote

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free