CVE-2022-23474CWE-94

editor.js contains Code Injection

Medium · published December 15, 2022

CVSS v3.1
6.1
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00569 · 46.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-12-15T02:08Z
EPSS history
Timeline
  • 15 DEC 02:08Z
    editor.js contains Code Injection
    cvelistv5