Reflected cross-site scripting (XSS) In @ckeditor/ckeditor5-link
Description
Cross-Site Scripting in @ckeditor/ckeditor5-link
Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The _createPreviewButton() function fails to sanitize the href attribute of a created <a> tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 10.0.1 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 10.0.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.