CVE-2021-32855: 
JavaScript vulnerability analysis and mitigation

Vditor, a browser-side Markdown editor, was found to contain a copy-paste cross-site scripting (XSS) vulnerability in versions prior to 3.8.7. The vulnerability was discovered on September 15, 2021, and was assigned CVE-2021-32855. The issue was reported to the maintainers and was subsequently fixed on September 22, 2021 (GitHub Security Lab).

The vulnerability was identified as a copy-paste cross-site scripting (XSS) issue in the Vditor text editor. The vulnerability is classified as CWE-79 (Cross-site Scripting). For successful exploitation, a victim needs to be tricked into copying a malicious payload into the text editor. The issue was discovered using CodeQL analysis (GitHub Security Lab).

The vulnerability could lead to cross-site scripting attacks when users interact with the affected text editor. The impact requires user interaction in the form of copying and pasting malicious content (GitHub Security Lab).

The vulnerability was fixed in commit 1b2382d with the implementation of HTML sanitization. Users should upgrade to version 3.8.7 or later to receive the security fix (GitHub Commit).