CVE-2023-41167

    Dashboard / Vulnerabilities / CVE-2023-41167

    CVE-2023-41167

    Published: 25 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: @webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.

    References: https://webiny.com, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41167.json, https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6, https://nvd.nist.gov/vuln/detail/CVE-2023-41167

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e69288bf5e710060b14497aae8317034c6cb4bcc

    Affected versions

    v5.37.1
    v5.37.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-41167 | CVE-DB