npm package
react-draft-wysiwyg
pkg:npm/react-draft-wysiwyg
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-3191 | Med | 6.1 | <= 1.15.0 | — | Apr 4, 2025 | All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the tag. | |
| CVE-2021-31712 | — | < 1.14.6 | 1.14.6 | Apr 24, 2021 | react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS. |
- affected <= 1.15.0
All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the tag.
- CVE-2021-31712Apr 24, 2021affected < 1.14.6fixed 1.14.6
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.