CVE-2020-4051: 
JavaScript vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was identified in the Dijit Editor's LinkDialog plugin affecting versions prior to 1.11.11, 1.12.0-1.12.8, 1.13.0-1.13.7, 1.14.0-1.14.6, 1.15.0-1.15.3, and 1.16.0-1.16.2. The vulnerability was discovered in June 2020 (GitHub Advisory).

The vulnerability exists in the Editor's LinkDialog plugin where HTML content in links could be processed without proper sanitization. This was addressed by adding configuration options including 'allowUnsafeHtml' (defaulting to false) which replaces potentially dangerous characters, and 'linkFilter' which can be used to control exactly what filtering is applied to link content (GitHub Commit).

The vulnerability could allow attackers to execute cross-site scripting (XSS) attacks through the LinkDialog plugin. The severity is rated as Low according to the GitHub security advisory (GitHub Advisory).

The vulnerability has been fixed in versions 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, and 1.16.3. Users should upgrade to these patched versions. For those unable to upgrade immediately, the new configuration options can be used to control HTML content filtering in links (GitHub Advisory).