{"id":"CVE-2024-34449","details":"Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true.","aliases":["GHSA-m5jf-8crm-r65m"],"modified":"2026-08-12T03:51:16.437118114Z","published":"2024-05-03T00:00:00Z","database_specific":{"cna_assigner":"mitre","isDisputed":true,"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34449.json"},"references":[{"type":"WEB","url":"https://github.com/Vanessa219/vditor/blob/b3a14d6e4462b0c17141e1fcc66173264ada64e0/README_en_US.md?plain=1#L310"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34449.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34449"},{"type":"REPORT","url":"https://github.com/Vanessa219/vditor/issues/1604"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vanessa219/vditor","events":[{"introduced":"9f6d195402780efe5bcc25ce3873d0b325b620f6"},{"last_affected":"9f6d195402780efe5bcc25ce3873d0b325b620f6"}],"database_specific":{"extracted_events":[{"introduced":"3.10.3"},{"last_affected":"3.10.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:b3log:vditor:3.10.3:*:*:*:*:*:*:*"}}],"versions":["3.10.3","v3.10.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34449.json"}}],"schema_version":"1.9.0"}