CVE-2023-41592

Advisory

Django Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
https://hacker.soarescorp.com/cve/2023-41592/

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Fixed, cursor jumps when editing inputs inside a table while editor is configured for `toolbarInline`
- Fixed, CVE-2023-41592 XSS vulnerability
- Fixed, text color hex codes are not changing the text color in the editor
- Fixed, page scrolls when we past large content with images in the editor
- Fixed, cross-site scripting vulnerability in Froala Editor 4.1.2 / CVE-2023-43263
- Fixed, changing text color or background causes loss of focus on selected text due to clicking the input
- Fixed, `toolbarSticky` does not work as expected
- Fixed, scrolling issue: pressing Enter scrolls window up when cursor is placed before specific text

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41592
• https://owasp.org/www-project-top-ten/
• https://owasp.org/Top10/A03_2021-Injection/
• https://hacker.soarescorp.com/cve/2023-41592/