Cross-site Scripting in React Draft Wysiwyg
Moderate severity
GitHub Reviewed
Published
May 6, 2021
to the GitHub Advisory Database
•
Updated Sep 11, 2023
Description
Published by the National Vulnerability Database
Apr 24, 2021
Reviewed
Apr 26, 2021
Published to the GitHub Advisory Database
May 6, 2021
Last updated
Sep 11, 2023
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a
javascript:
URi in a Link Target of the link decorator indecorators/Link/index.js
when a draft is shared across users, leading to XSS.References