Medium severity5.4OSV Advisory· Published Jul 25, 2022· Updated Jun 17, 2026

CVE-2022-21802

Description

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
grapesjsnpm	>= 0	—

Affected products

Grapesjs/GrapesjsOSV2 versions
v0.10.2, v0.10.4, v0.10.6, …+ 1 more
- (no CPE)range: v0.10.2, v0.10.4, v0.10.6, …
- cpe:2.3:a:grapesjs:grapesjs:*:*:*:*:*:node.js:*:*range: <0.19.5
ghsa-coords
pkg:npm/grapesjs
Range: >= 0

Patches

Vulnerability mechanics

References

github.com/artf/grapesjs/commit/13e85d152d486b968265c4b8017e8901e7d89ff3nvdPatchThird Party AdvisoryWEB
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936781nvdPatchThird Party AdvisoryWEB
security.snyk.io/vuln/SNYK-JS-GRAPESJS-2935960nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-589f-c66p-hxr4ghsaADVISORY
github.com/artf/grapesjs/issues/4411%23issuecomment-1167202709nvdIssue TrackingThird Party AdvisoryWEB
github.com/artf/grapesjs/releases/tag/v0.19.5nvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-21802ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000