CVE-2022-23474

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security-advisories@github.com

Published

2022-12-15

Last modified

2025-04-17

Weaknesses

CWE-79, CWE-94

Affected products

• Editor.js (Codex)
• Editor.js (Codex-team)

References

• https://github.com/codex-team/editor.js/pull/2100
• https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/