CVE-2022-23474 MEDIUM

CVE-2022-23474: editor.js contains Code Injection

Vendor Codex-Team

Product editor.js

Weakness CWE-94 · Code injection

Published December 15, 2022

Last update April 17, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.

Key dates

02Disclosure timeline

December 15, 2022 CVE published

April 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-23474 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation CVE-2024-28118 Grav vulnerable to Server Side Template Injection (SSTI) CVE-2026-23733 Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber