CVE-2023-27472CWE-79

HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next

High · published March 6, 2023

CVSS v3.1
8.2
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name. This issue has been patched in version 1.28.1 of the application. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-03-06T18:12Z
EPSS history
Timeline
  • 06 MAR 18:12Z
    HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next
    cvelistv5