CVE-2022-0341: Cross-site Scripting in vditor
Summary
CVE-2022-0341: Cross-site Scripting in vditor. Affects vditor versions < 3.8.11. Fixed in 3.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vditor is an open-source markdown editor for web browsers. It provides users with a convenient way to write and edit markdown content. However, versions prior to 3.8.11 of Vditor are vulnerable to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Vditor allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability is classified as moderate severity with a CVSS score of 5.4. It is identified as CWE-79, which relates to improper neutralization of input during web page generation.
How To Fix
Latest published version: 4.0.1 as of 22 Oct 2026
npm install vditor@4.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.11
This is the first release that contains the fix.
npm install vditor@3.8.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization on user-generated content. This can help mitigate the risk of XSS attacks. Here is an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
return input.replace(/</g, '<').replace(/>/g, '>');
}
Conclusion
In conclusion, Vditor versions prior to 3.8.11 are vulnerable to cross-site scripting (XSS) attacks. It is crucial to upgrade to the latest secure version of Vditor (3.8.11 or later) to mitigate the risk. Implementing input validation and sanitization can provide a temporary workaround until the upgrade is performed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vditor →
FAQ
Vditor is an open-source markdown editor for web browsers. It provides users with a convenient way to write and edit markdown content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as stealing sensitive information or performing actions on behalf of the user.
This vulnerability is classified as moderate severity with a CVSS score of 5.4.
To fix this vulnerability, it is recommended to upgrade Vditor to version 3.8.11 or later. This version includes a patch that addresses the XSS vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization on user-generated content.
References
Related vulnerabilities
Recent vulnerabilities recorded for vditor.
