CVE-2022-0350: Cross-site Scripting in vditor
Summary
CVE-2022-0350: Cross-site Scripting in vditor. Affects vditor versions < 3.8.13. Fixed in 3.8.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vditor is an open-source markdown editor written in TypeScript. It provides a rich set of features for editing and rendering markdown content. The vulnerability identified as CVE-2022-0350 is a Cross-site Scripting (XSS) vulnerability that existed in the vditor GitHub repository prior to version 3.8.13.
Vulnerability Detail
The Cross-site Scripting (XSS) vulnerability allowed an attacker to inject malicious scripts into the vditor application. This type of vulnerability can lead to the execution of arbitrary code in the context of the victim's browser, potentially compromising user data or performing unauthorized actions on behalf of the user.
How To Fix
Latest published version: 4.0.1 as of 22 Oct 2026
npm install vditor@4.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.13
This is the first release that contains the fix.
npm install vditor@3.8.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Cross-site Scripting (XSS) vulnerability in vditor has been addressed in version 3.8.13. Users are advised to update their installations to this version or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vditor →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface websites.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
No, the recommended solution is to update vditor to version 3.8.13 or later.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to update to the latest version of vditor to ensure the security of your application.
This vulnerability was discovered by the GitHub Security Lab.
Related vulnerabilities
Recent vulnerabilities recorded for vditor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
