Snyk Security Database

jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the sanitizeHTMLElement. An attacker can execute arbitrary JavaScript in the context of the user's browser by crafting a malicious href attribute that bypasses incomplete normalization checks. This can be triggered when a victim clicks a specially crafted link rendered from stored editor content.

copier is an A library for rendering project templates.

Affected versions of this package are vulnerable to Directory Traversal via percent-encoded parent-directory segments or encoded path separators in template URLs. An attacker can execute unsafe template features from a repository outside the trusted prefix by crafting a URL that bypasses trusted repository checks after user interaction.

Affected versions of this package are vulnerable to Directory Traversal through the move and remove folder operations in FileSystemNotebookRepo. An authenticated attacker with permission to rename notes or use folder operations can supply .. or URL-encoded traversal segments in a note or folder path to make Zeppelin move, write, or delete files and directories outside the configured notebook root. This can corrupt or remove filesystem content beyond the notebook directory and break notebook management for affected users.