CVE-2022-23474: editor.js contains Code Injection

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-15 · updated 2026-06-17
Weakness: CWE-94

Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Affected products

codex-team editor.js: before 2.26.0 — fixed in 2.26.0

How to fix

Upgrade to a fixed version: codex-team editor.js 2.26.0. Check the vendor advisory for mitigations.

References

https://github.com/codex-team/editor.js/pull/2100
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/
https://github.com/codex-team/editor.js/pull/2100
https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/

Get alerted when CVE-2022-23474 or the next vulnerability affects your stack