Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@seafile/sdoc-editor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4npmAmendedPublished

    Seafile Server has multiple stored XSS vulnerabilities

    CVE-2026-30587 · GHSA-rqj3-x344-qvxc

    Affected
    • npm @seafile/sdoc-editor >= 3.0.0, < 3.0.75; < 2.0.209
    Fixed in
    2.0.2093.0.75· Vendor fix available
    Issue
    Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags.

    Recommended action: Upgrade to 3.0.75 or 2.0.209 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →