CVE-2020-22864: Cross-Site Scripting in froala-editor
Summary
CVE-2020-22864: Cross site scripting in froala-editor. Affects froala-editor versions < 4.0.11. Fixed in 4.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The froala-editor package is a popular npm package that provides a WYSIWYG editor for web applications. It allows users to easily create and edit rich text content with features like formatting, image insertion, and video embedding. However, versions of froala-editor up to 4.0.6 are vulnerable to a cross-site scripting (XSS) attack in the Insert Video function.
Vulnerability Detail
The vulnerability in froala-editor allows attackers to execute arbitrary web scripts or HTML through a cross-site scripting (XSS) attack. Specifically, the Insert Video function is affected, enabling attackers to inject malicious code into the video URL input field. When the video is embedded in the editor, the injected code will be executed in the context of the user's browser, potentially leading to unauthorized actions, data theft, or further exploitation.
How To Fix
Latest published version: 5.5.0 as of 23 Oct 2026
npm install froala-editor@5.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.11
This is the first release that contains the fix.
npm install froala-editor@4.0.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the Insert Video function or implement input sanitization to prevent the execution of malicious scripts. Here is an example of input sanitization using the DOMPurify library:
import DOMPurify from 'dompurify';
const videoUrl = '...'; // User input
const sanitizedUrl = DOMPurify.sanitize(videoUrl);
// Use the sanitized URL in the Froala editor
Conclusion
The froala-editor package up to version 4.0.6 is vulnerable to cross-site scripting (XSS) attacks in the Insert Video function. To protect applications, it is crucial to upgrade to version 4.0.11 or later. Alternatively, developers can apply input sanitization or disable the vulnerable function temporarily. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for froala-editor →
FAQ
Froala Editor is a WYSIWYG editor package for web applications, providing rich text editing capabilities.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability allows attackers to execute arbitrary scripts or HTML in the context of a user's browser, potentially leading to unauthorized actions, data theft, or further exploitation.
Yes, upgrading froala-editor to version 4.0.11 or later fixes the vulnerability. Developers should update their package dependencies accordingly.
If immediate upgrading is not possible, developers can disable the Insert Video function or implement input sanitization to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for froala-editor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
