{"id":"CVE-2023-41167","details":"@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.","aliases":["GHSA-3x59-vrmc-5mx6"],"modified":"2026-08-12T03:51:15.360649179Z","published":"2023-08-25T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41167.json"},"references":[{"type":"WEB","url":"https://webiny.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41167.json"},{"type":"ADVISORY","url":"https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41167"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/webiny/webiny-js","events":[{"introduced":"0"},{"fixed":"e69288bf5e710060b14497aae8317034c6cb4bcc"}],"database_specific":{"cpe":"cpe:2.3:a:webiny:webiny:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.37.2"}],"source":["DESCRIPTION","CPE_RANGE"]}}],"versions":["v5.37.1","v5.37.0","v5.36.0","v5.35.0","v5.33.4","v5.33.3","v5.33.0","v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.24.0","v5.21.0","v5.14.0","v5.11.0","v5.9.0","v5.5.0","v5.3.0","v5.1.0","v5.0.0","v4.9.0","v4.8.0","v4.4.0","v4.1.0","v4.0.2","v4.0.0","v1.13.1","v1.13.0","v1.12.7","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.11.0","v1.10.5","v1.10.3","v1.8.0","v1.7.0","v1.6.0","v1.5.1","v1.5.0","v1.4.0","v1.3.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41167.json"}}],"schema_version":"1.9.0"}