Skip to main content
cve.nowby Sazabi
← npm
npmPackage

simditor

2 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2
Registry
npm

Advisories 2

  • Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.

    Affected: fixed in 2.3.22.

  • Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.

    Affected: through 2.3.11.