预览功能存在XSS漏洞

Vanessa219 / vditor

♏ 一款浏览器端的 Markdown 编辑器，支持所见即所得（富文本）、即时渲染（类似 Typora）和分屏预览模式。An In-browser Markdown editor, support WYSIWYG (Rich Text), Instant Rendering (Typora-like) and Split View modes.

https://b3log.org/vditor

MIT License

8.09k stars 844 forks source link

预览功能存在XSS漏洞 #1604

Closed rockmelodies closed 3 months ago

rockmelodies commented 3 months ago

"vditor": "^3.10.3", 最新版本

Vanessa219 commented 3 months ago

sanitize 这个需要设置为 true