Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Arbitrary Code Execution via Braft-Editor Embed Media

CVE-2021-27524 · published 3 years ago
Summary

The Braft-Editor in version 2.3.8 contains a security weakness that lets hackers inject malicious code when users interact with the embed media feature. This could allow attackers to take control of your website or steal sensitive information. Update to the latest version of Braft-Editor to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm tenon-js braft-editor <= 2.3.8
– margox braft-editor 2.3.8
cpe:2.3:a:margox:braft-editor:2.3.8:*:*:*:*:*:*:*
Original advisory text
Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Aug 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-jfrf-vv54-j2jg · GHSA
CVE-2021-27524 · NVD
Track software like this
Free during beta