CVE-2021-41086 (JavaScript, published 2021-09-21T21:15Z)
Description: value: jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jsuites/jsuites
Files changed:
dist/jsuites.basic.js
dist/jsuites.js
dist/jsuites.layout.css
dist/jsuites.layout.js
package.json
src/editor.js
Commit message: Editor sanitize parser updates.

Vulnerable code:
    var version = '4.4.0';
               if (! obj.options.acceptImages) {
           } else {
               // Remove attributes
               var numAttributes = element.attributes.length - 1;
                   element.removeAttribute(element.attributes[i].name);
    var version = '4.4.0';
               if (! obj.options.acceptImages) {
           } else {
               // Remove attributes
               var numAttributes = element.attributes.length - 1;
                   element.removeAttribute(element.attributes[i].name);
                    if (state === null || state == 1) {
    obj.select = function(o) {
        var menu = el.querySelectorAll('nav a');
        for (var i = 0; i < menu.length; i++) {
            menu[i].classList.remove('selected');
        }
        o.classList.add('selected');

        // Better navigation
        if (options && options.collapse == true) {
            if (o.classList.contains('show')) {
                menu = el.querySelectorAll('nav');
                for (var i = 0; i < menu.length; i++) {
                    menu[i].style.display = '';
                }
                o.style.display = 'none';
            } else {
                menu = el.querySelectorAll('nav');
                for (var i = 0; i < menu.length; i++) {
                    menu[i].style.display = 'none';
                }
                menu = el.querySelector('.show');
                if (menu) {
                    menu.style.display = 'block';
                }
                menu = jSuites.findElement(o.parentNode, 'selected');
                if (menu) {
                    menu.style.display = '';
            setTimeout(function() {
                obj.hide();
            }, 0);
    var actionDown = function(e) {
            obj.select(e.target);
        el.addEventListener('touchstart', actionDown);
        el.addEventListener('mousedown', actionDown);
    "version": "4.9.10",
               if (! obj.options.acceptImages) {
           } else {
               // Remove attributes
               var numAttributes = element.attributes.length - 1;
                   element.removeAttribute(element.attributes[i].name);

Fixed code:
    var version = '4.9.11';
        if (! src) {
            src = '';
        }

    // Valid properties
    var validProperty = ['width', 'height', 'align', 'border', 'src', 'tabindex'];

               if (! obj.options.acceptImages || ! element.src) {
           }
           // Remove attributes
           var attr = [];
           var numAttributes = element.attributes.length - 1;
           if (numAttributes > 0) {
                   attr.push(element.attributes[i].name);
               attr.forEach(function(v) {
                   if (validProperty.indexOf(v) == -1) {
                       element.removeAttribute(v);
                   }
               });
    var version = '4.9.11';
        if (! src) {
            src = '';
        }

    // Valid properties
    var validProperty = ['width', 'height', 'align', 'border', 'src', 'tabindex'];

               if (! obj.options.acceptImages || ! element.src) {
           }
           // Remove attributes
           var attr = [];
           var numAttributes = element.attributes.length - 1;
           if (numAttributes > 0) {
                   attr.push(element.attributes[i].name);
               attr.forEach(function(v) {
                   if (validProperty.indexOf(v) == -1) {
                       element.removeAttribute(v);
                   }
               });
    font-weight: bold;
                    if (state == 1) {
    obj.select = function(o, e) {
        if (o.tagName == 'NAV') {
            var m = el.querySelectorAll('nav');
            for (var i = 0; i < m.length; i++) {
                m[i].style.display = 'none';
            }
            o.style.display = '';
            o.classList.add('selected');
        } else {
            var m = el.querySelectorAll('nav a');
            for (var i = 0; i < m.length; i++) {
                m[i].classList.remove('selected');
            }
            o.classList.add('selected');

            // Better navigation
            if (options && options.collapse == true) {
                if (o.classList.contains('show')) {
                    m = el.querySelectorAll('nav');
                    for (var i = 0; i < m.length; i++) {
                        m[i].style.display = '';
                    }
                    o.style.display = 'none';
                } else {
                    m = el.querySelectorAll('nav');
                    for (var i = 0; i < m.length; i++) {
                        m[i].style.display = 'none';
                    }
                    m = el.querySelector('.show');
                    if (m) {
                        m.style.display = 'block';
                    }
                    m = jSuites.findElement(o.parentNode, 'selected');
                    if (m) {
                        m.style.display = '';
                    }
        if (options && typeof(options.onclick) == 'function') {
            options.onclick(obj, e);
        }

            obj.hide();
    var action = function(e) {
            obj.select(e.target, e);
        el.addEventListener('touchsend', action);
        el.addEventListener('mouseup', action);
    "version": "4.9.11",
        if (! src) {
            src = '';
        }

    // Valid properties
    var validProperty = ['width', 'height', 'align', 'border', 'src', 'tabindex'];

               if (! obj.options.acceptImages || ! element.src) {
           }
           // Remove attributes
           var attr = [];
           var numAttributes = element.attributes.length - 1;
           if (numAttributes > 0) {
                   attr.push(element.attributes[i].name);
               attr.forEach(function(v) {
                   if (validProperty.indexOf(v) == -1) {
                       element.removeAttribute(v);
                   }
               });