Cross-Site Scripting Vulnerability in Lexical by Facebook
CVE-2023-30792

6.1MEDIUM

Key Information:

Vendor

Meta Platforms, Inc

Status
Lexical
Vendor
CVE Published:
29 April 2023

What is CVE-2023-30792?

The Lexical application from Facebook is affected by a vulnerability that allows cross-site scripting (XSS) through the improper handling of anchor tag hrefs. Versions prior to v0.10.0 can inadvertently render javascript: URLs, presenting a significant security risk when the input is derived from untrusted sources. This flaw could enable attackers to execute malicious scripts on user devices upon clicking compromised links, compromising data integrity and user security.

Affected Version(s)

Lexical 0.0.0 < 0.10.0

References

https://github.com/facebook/lexical/releases/tag/v0.10.0
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.