CVE-2022-23474

PoC ×2—

CVSS 3.1

6.1 medium

EPSS

<1%p43

Published

Dec 15, 2022 (Dec 15, 2022)

Modified

Jun 17, 2026

Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Vendors: codex
Products: editor.js
Weakness: CWE-94, CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.