Cross-site Scripting in jsoneditor

中危 6.1CVE-2020-23849 · GHSA-q854-j362-cfq9 · Published 11/01/2021 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
jsoneditor jsoneditoronline	`≥ 8.6.6, < 9.0.2`	`9.0.2`
jsoneditor npm	`< 9.0.2`	`9.0.2`

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.

NVD description

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.