CVE-2021-31712

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-24 · updated 2026-06-17
Weakness: CWE-79

Description

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.

Affected products

React Draft Wysiwyg Project React Draft Wysiwyg: before 1.14.6 — fixed in 1.14.6

How to fix

Upgrade to a fixed version: React Draft Wysiwyg Project React Draft Wysiwyg 1.14.6. Check the vendor advisory for mitigations.

References

https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380
https://github.com/jpuri/react-draft-wysiwyg/issues/1102
https://github.com/jpuri/react-draft-wysiwyg/pull/1104
https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380
https://github.com/jpuri/react-draft-wysiwyg/issues/1102
https://github.com/jpuri/react-draft-wysiwyg/pull/1104

Get alerted when CVE-2021-31712 or the next vulnerability affects your stack