CVE-2022-23474 editor.js contains Code Injection
An attacker can execute arbitrary code by pasting malicious input into the Editor.js block-style editor, affecting applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-23474?
CVE-2022-23474 is a medium-severity code injection vulnerability in codex-team editor.js, published on 15 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.
Which versions are affected by CVE-2022-23474?
2 open source packages ship an affected version, including @editorjs/editorjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@editorjs/editorjs npm | All versions | 2.26.0 |
@editorjs/editorjs npm | All versions | 2.26.0 |
Products include Codex Editor.js.
How do I fix CVE-2022-23474?
Upgrade @editorjs/editorjs to 2.26.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-23474 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23474 exists.
Sources
Also known as GHSA-6mvj-2569-3mcm.