{"action":"Upgrade froala-editor to 3.2.3 or later.","affected":[{"fixed":"3.2.3","introduced":"0"}],"component":"froala-editor","cve_ids":["CVE-2019-19935"],"ecosystem":"npm","epss":0.01847,"exploited":false,"fixed_versions":["3.2.3"],"ghsa_id":"GHSA-h236-g5gh-vq6c","id":"tcs_01M5KFST8X5K4P06G6Z3XHX8S0","modified_at":"2023-11-08T04:01:29.960993Z","published_at":"2022-02-10T23:32:51Z","references":["https://osv.dev/vulnerability/GHSA-h236-g5gh-vq6c","https://nvd.nist.gov/vuln/detail/CVE-2019-19935","https://blog.compass-security.com/2020/07/yet-another-froala-0-day-xss","https://compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2020-004_DOM_XSS_in_Froala_WYSIWYG_HTML_Editor.txt","https://froala.com/wysiwyg-editor/changelog/#3.2.3","https://github.com/froala/wysiwyg-editor-release","https://github.com/froala/wysiwyg-editor/compare/v3.0.5...v3.0.6","https://snyk.io/vuln/npm:froala-editor","http://packetstormsecurity.com/files/158300/Froala-WYSIWYG-HTML-Editor-3.1.1-Cross-Site-Scripting.html"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-h236-g5gh-vq6c","url":"https://osv.dev/vulnerability/GHSA-h236-g5gh-vq6c"}],"summary":"DOM-based cross-site scripting in Froala Editor"}