{"id":"GHSA-cr56-66mx-293v","aliases":[],"status":"published","title":"Cross-Site Scripting in @toast-ui/editor","description":"Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.\n\n## Recommendation\n\nUpgrade to version 2.2.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-03T15:53:50Z","modified":"2023-04-03T21:23:05Z","fixes":[{"ecosystem":"npm","package":"@toast-ui/editor","fixed_in":["2.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@toast-ui/editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@toast-ui/editor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]}],"references":[{"url":"https://github.com/nhn/tui.editor/issues/733","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1521","tags":["web"]},{"url":"https://github.com/nhn/tui.editor/pull/1010","tags":["web"]},{"url":"https://github.com/nhn/tui.editor/commit/5f62f5eeda9e8f8bcf2075e8e0e10d22bf56d1a7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cr56-66mx-293v"},{"url":"https://github.com/nhn/tui.editor","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-cr56-66mx-293v","title":"Cross-Site Scripting in @toast-ui/editor","description":"Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.\n\n## Recommendation\n\nUpgrade to version 2.2.0 or later.","status":"published","published":"2020-09-03T15:53:50Z","modified":"2023-04-03T21:23:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"osv":[{"id":"GHSA-cr56-66mx-293v","title":"Cross-Site Scripting in @toast-ui/editor","description":"Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.\n\n## Recommendation\n\nUpgrade to version 2.2.0 or later.","status":"published","published":"2020-09-03T15:53:50Z","modified":"2021-10-04T21:12:14Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}