What is CVE-2022-23474?

CVE-2022-23474 is a medium-severity vulnerability in Codex Editor.js, classified under Code Injection. CVSS score: 6.1/10. Published 2022-12-15.

How severe is CVE-2022-23474?

Medium severity. CVSS v3 base score is 6.1 out of 10.

RCE in Codex Editor.js

CVE-2022-23474

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.005 (41.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Codex Editor.js
Codex-team Editor.js — versions 2.26.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory)
security-advisories@github.com (Exploit, Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-23474?: CVE-2022-23474 is a medium-severity vulnerability in Codex Editor.js, classified under Code Injection. CVSS score: 6.1/10. Published 2022-12-15.
How severe is CVE-2022-23474?: Medium severity. CVSS v3 base score is 6.1 out of 10.