CVE-2021-31712
CVE-2021-31712
This page contains facts from public vulnerability sources. Check the original advisory before updating.
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
CVSS 5.4 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
react-draft-wysiwyg npm
- Affected ranges
- SEMVER: < 1.14.6
Update to 1.14.6