Medium severity6.1NVD Advisory· Published Apr 4, 2025· Updated Jun 17, 2026

CVE-2025-3191

Description

All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the tag.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
react-draft-wysiwygnpm	<= 1.15.0	—

Affected products

ghsa-coords
pkg:npm/react-draft-wysiwyg
Range: <= 1.15.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fq5x-7292-2p5rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-3191ghsaADVISORY
gist.github.com/th4s1s/175ae4b2632096059b42377dd6c49d47nvdWEB
security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000