Description
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
Remediation
References
https://github.com/sparksuite/simplemde-markdown-editor/issues/721
Related Vulnerabilities
CVE-2020-28472 Vulnerability in maven package org.webjars.npm:aws-sdk
CVE-2022-39218 Vulnerability in npm package @fastly/js-compute
CVE-2021-21122 Vulnerability in npm package electron
CVE-2023-36470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-script
CVE-2023-49447 Vulnerability in maven package com.jfinal:jfinal