Skip to content
OpenAdvisories
Medium · 6.1 CVE-2023-30792 EUVD-2023-35154GHSA-6m63-xcvc-h2vg

Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where…

Published Apr 29, 2023 · Updated Jan 30, 2025 · Assigned by facebook

Vendor: Meta Platforms Product: Lexical

Description

Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.

Affected products

VendorProductAffectedFixed
Meta Platforms Lexical 0.0.0 – < 0.10.0 0.10.0

References