CVE-2023-41592

Advisory

Affected versions of django-froala-editor are vulnerable to Cross-Site Scripting (XSS) due to CVE-2023-41592 in the underlying Froala WYSIWYG editor.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Fixed, Editor does not re-upload pasted images with some content
- Fixed, `image.beforeUpload` event is not triggering when pasting rich content with images from MS Word
- Fixed, font format is incorrect when pasting list from MS doc
- Fixed, video plugin is not compatible with YouTube short video links
- Fixed, unexpected `DIV` replication when pasting tables in editor
- Fixed, CVE-2023-41592 XSS vulnerability
- Fixed, alignment and font size dropdowns are unresponsive in Inline Toolbar on Andriod mobile
- Fixed, Tracked Changes: When adding/pasting unordered lists with different formatting the single formatting applies on whole list

Resources

• https://github.com/froala/django-froala-editor/commit/fcf0084c6522b5eccbdbe5a3d7bbc7eb76b69a0f
• https://pypi.org/project/django-froala-editor
• https://data.safetycli.com/changelogs/django-froala-editor/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41592