Skip to content
OpenAdvisories

Package · npm

react-draft-wysiwyg

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-3191

    React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button

    All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.

    react-draft-wysiwyg npm
  • Medium 5.4
    CVE-2021-31712

    Cross-site Scripting in React Draft Wysiwyg

    react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.

    react-draft-wysiwyg npm