{"id":"CVE-2021-31712","aliases":["GHSA-qcg2-h349-vwm3"],"url":"https://o3.security/vulnerability/CVE-2021-31712","summary":"Cross-site Scripting in React Draft Wysiwyg","details":"react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.","published":"2021-04-24T21:15:07.490Z","modified":"2026-07-08T05:59:46.617833576Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"react-draft-wysiwyg","fixedVersion":"1.14.6"}],"fix":{"url":"https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380","label":"jpuri/react-draft-wysiwyg@d2faeb6"},"references":[{"type":"REPORT","url":"https://github.com/jpuri/react-draft-wysiwyg/issues/1102"},{"type":"FIX","url":"https://github.com/jpuri/react-draft-wysiwyg/commit/d2faeb612b53f10dff048de7dc57e1f4044b5380"},{"type":"FIX","url":"https://github.com/jpuri/react-draft-wysiwyg/pull/1104"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:59:46.617833576Z"}}