Description
All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser.
## Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mavon-editor | < 2.8.2 | 2.8.2 | GHSA-jfcc-rm7f-xgf8 |
References
- https://github.com/hinesboy/mavonEditor/issues/472 web
- https://github.com/hinesboy/mavonEditor/pull/548 web
- https://github.com/hinesboy/mavonEditor/commit/5592ec3761bd3b5a12ba6f99ce3c4057c6e33f72 web
- https://github.com/hinesboy/mavonEditor package
- https://snyk.io/vuln/SNYK-JS-MAVONEDITOR-459108 web
- https://www.npmjs.com/advisories/1169 web
- https://www.npmjs.com/package/mavon-editor web