CVE-2018-19056

Description

pandao Editor.md 1.5.0 has DOM XSS via input starting with a `<<` substring, which is mishandled during construction of an `A` element.

Affected packages (1)

• npm/editor.md

CVSS scores

References (4)

• ADVISORYhttps://github.com/advisories/GHSA-x3g3-334f-q6h4
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-19056
• PATCHhttps://github.com/pandao/editor.md
• WEBhttps://github.com/pandao/editor.md/issues/634