CVE-2021-4103: Cross-site Scripting in vditor
Summary
CVE-2021-4103: vditor Vulnerable to Cross-site Scripting in SVG events. Affects vditor versions < 3.8.11. Fixed in 3.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vditor is an open-source markdown editor for the web. It provides users with a rich set of features for editing and formatting markdown content. However, the package is vulnerable to a cross-site scripting (XSS) attack due to the lack of user input filtering.
Vulnerability Detail
The vulnerability in vditor allows an attacker to inject malicious scripts into the application, which are then executed in the context of the user's browser. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability is classified as CWE-79 (Cross-site Scripting).
How To Fix
Latest published version: 4.0.1 as of 22 Oct 2026
npm install vditor@4.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.11
This is the first release that contains the fix.
npm install vditor@3.8.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization on the server-side to filter out any potentially malicious user input. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the impact of XSS attacks.
Conclusion
In conclusion, the vulnerability in vditor allows for cross-site scripting attacks, which can have severe security implications. It is crucial to upgrade to the latest version of vditor (3.8.11 or later) or apply the recommended workarounds to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vditor →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is important to apply the recommended fixes as soon as possible to prevent any potential exploitation.
No, versions prior to 3.8.11 are affected by this vulnerability. It is recommended to upgrade to the latest version to ensure the security of your application.
No, there is no publicly available proof-of-concept or demonstration for this vulnerability at the time of this advisory.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-cxm3-v4mv-6mh8/GHSA-cxm3-v4mv-6mh8.json
References
Related vulnerabilities
Recent vulnerabilities recorded for vditor.
