{"id":"GHSA-cxm3-v4mv-6mh8","summary":"vditor Vulnerable to Cross-site Scripting in SVG events","details":"vditor does not filter user input in SVG events, leading to XSS \n\n### PoC\n\n```html\n\u003c/a\u003e\n\u003csvg\u003e\u003canimate onbegin=alert(11) attributeName=x dur=1s\u003e\n```","aliases":["CVE-2021-4103"],"modified":"2023-11-08T04:06:50.115961Z","published":"2022-01-28T22:04:11Z","database_specific":{"nvd_published_at":"2022-01-23T02:15:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-01-28T21:55:58Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4103"},{"type":"WEB","url":"https://github.com/Vanessa219/vditor/issues/1133"},{"type":"WEB","url":"https://github.com/vanessa219/vditor/commit/8d4d0889dd72b2f839e93a49db3da3a370416c7d"},{"type":"PACKAGE","url":"https://github.com/vanessa219/vditor"},{"type":"WEB","url":"https://huntr.dev/bounties/67b980af-7357-4879-9448-a926c6474225"}],"affected":[{"package":{"name":"vditor","ecosystem":"npm","purl":"pkg:npm/vditor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-cxm3-v4mv-6mh8/GHSA-cxm3-v4mv-6mh8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}