CVE-2025-3191: React Draft Wysiwyg Cross-Site Scripting (XSS) via Embedded Button
Summary
CVE-2025-3191: React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button. Affects react-draft-wysiwyg versions < 1.15.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
React Draft Wysiwyg is a popular rich text editor for React applications, allowing developers to create and manage content with ease. It provides features such as text formatting, media embedding, and customizable toolbars. However, all versions of this package are vulnerable to a Cross-Site Scripting (XSS) attack through the Embedded button, which can lead to malicious scripts being executed in the context of the user's browser.
Vulnerability Detail
The vulnerability arises from the way the Embedded button processes user input, allowing attackers to inject malicious scripts. When a user saves content that includes this payload, it gets stored in an <iframe> tag, which can then be executed when the content is rendered. This can lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before it is processed by the Embedded button. This can be done using libraries such as DOMPurify to clean the input and remove any potentially harmful scripts. Here is an example of how to implement this:
import DOMPurify from 'dompurify';
const sanitizedInput = DOMPurify.sanitize(userInput);
// Use sanitizedInput instead of userInput in your application.
Conclusion
The react-draft-wysiwyg package is vulnerable to a Cross-Site Scripting (XSS) attack via the Embedded button, which can have serious implications for user security. It is crucial to update to the patched version to protect against potential exploits. Additionally, implementing input sanitization can serve as a temporary workaround.
See every vulnerability recorded for react-draft-wysiwyg →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If exploited, this vulnerability can lead to unauthorized actions being performed in the context of a user’s session, data theft, or other malicious activities.
Yes, a patch is available. Update the react-draft-wysiwyg package to version 1.15.1 or later to mitigate the vulnerability.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for react-draft-wysiwyg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
