CVE-2008-6681
Cross-Site Scripting in dojo
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element.
- Record
CVE-2008-6681- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element.
- Record
CVE-2008-6681- Updated
- 2026-11-02
EUVDEUVD-2020-0702 No score
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element.
- Record
EUVD-2020-0702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-39cx-xcwj-3rc4 No score
Cross-Site Scripting in dojo
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized.
Recommendation
Update to version 1.1.0 or later.
- Record
GHSA-39cx-xcwj-3rc4- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-39cx-xcwj-3rc4 No score
Cross-Site Scripting in dojo
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized.
Recommendation
Update to version 1.1.0 or later.
- Record
GHSA-39cx-xcwj-3rc4- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dojonpm |
before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-6681 is a medium vulnerability (CVSS 4.3) in Dojotoolkit Dojo, published April 9, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in dojo 1.1.0.
References
exchange.xforce.ibmcloud.com/vulnerabilities/49883
securityfocus.com/bid/34661
dojotoolkit.org/book/dojo-1-1-release-notes
trac.dojotoolkit.org/ticket/2140
bugs.dojotoolkit.org/ticket/2140
npmjs.com/advisories/107
nvd.nist.gov/vuln/detail/CVE-2008-6681
github.com/advisories/GHSA-39cx-xcwj-3rc4