Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized.

Recommendation

Update to version 1.1.0 or later.

References

• https://bugs.dojotoolkit.org/ticket/2140
• https://www.npmjs.com/advisories/107
• https://nvd.nist.gov/vuln/detail/CVE-2008-6681
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49883
• http://trac.dojotoolkit.org/ticket/2140
• http://www.dojotoolkit.org/book/dojo-1-1-release-notes
• http://www.securityfocus.com/bid/34661
• http://trac.dojotoolkit.org/changeset/15346