This repository has been archived by the owner on Apr 26, 2022. It is now read-only.

XSS in HTML-5-WYSIWYG-Editor #5

Open

soaj1664 opened this issue Apr 13, 2014 · 0 comments

soaj1664 commented Apr 13, 2014

Hi,

The editor is vulnerable to an XSS. The editor allows users to insert link and if instead of normal link, I input JavaScript URI

javascript:alert%28location%29

then it works. The attacker can execute arbitrary code of his choice. Please fix this issue. Thanks

The text was updated successfully, but these errors were encountered:

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.