Skip to content

Instantly share code, notes, and snippets.

@Masamuneee

Masamuneee/ContentTools.md Secret

Last active November 29, 2024 10:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Masamuneee/657f2e2b0eb5bf9b0d4dbb79f00dac37 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Masamuneee/657f2e2b0eb5bf9b0d4dbb79f00dac37 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ContentTools.md

Overview

ContentTools is a JS library for building WYSIWYG editors for HTML content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the attribute onload in img that allow attacker can inject malicious Javascript code.

Here are steps to reproduce:

  1. Go to demo page: https://getcontenttools.com/demo
  2. Add image tag onload:

XXS

  1. Save the change:

XSS2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment