CVE-2023-42426

MediumCVSS 6.1

Published: 25/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

52th percentile - higher than 52% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in Froala Editor v4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, leading to session hijacking, redirects, or theft of sensitive data.

Recommendation

It is recommended to immediately update Froala Editor to the latest available version that includes a fix for this vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert link' parameter in the 'Insert Image' component.