GrapesJS code is open to XSS issues because values are inserted into DOM without escaping, e.g. https://github.com/artf/grapesjs/blob/dev/src/assetmanager/view/AssetImageView.js#L30 If model.getFilename() returns .jpg, this can result in an account takeover. Instead the code should be for example: Similar issue here https://github.com/artf/grapesjs/blob/dev/src/assetmanager/view/AssetImageView.js#L15 and fix would be the same: To be one the save side, e...

Issue #3596💬 AnsweredOpened July 6, 2021by aimeos0 reactions

bug documentation security style-manager

Values are not escaped

Quick answerby aimeos

@artf What are your plans because the vulnerability of GrapesJS to XSS is a pretty big security problem

Question

GrapesJS code is open to XSS issues because values are inserted into DOM without escaping, e.g. https://github.com/artf/grapesjs/blob/dev/src/asset_manager/view/AssetImageView.js#L30

If model.getFilename() returns <img src=x onerror=alert(document.cookie)>.jpg, this can result in an account takeover. Instead the code should be for example:

    return `
      <div class="${_.escape(pfx)}name">${_.escape(name)}</div>
      <div class="${_.escape(pfx)}dimensions">${_.escape(dim)}</div>
    `;

Similar issue here https://github.com/artf/grapesjs/blob/dev/src/asset_manager/view/AssetImageView.js#L15 and fix would be the same:

    return `
      <div class="${_.escape(pfx)}preview" style="background-image: url('${_.escape(src)}');"></div>
      <div class="${_.escape(pfx)}preview-bg ${_.escape(this.ppfx)}checker-bg"></div>
    `;

To be one the save side, everything that is injected into HTML code must be escaped.

Answers (4)

aimeos• July 14, 2021

@artf What are your plans because the vulnerability of GrapesJS to XSS is a pretty big security problem

artf• July 14, 2021

Yeah thanks for the report @aimeos I'll fix it in the next version for sure

aimeos• July 14, 2021

@artf The documentation also uses ${var} to insert variables into templates often. This should also be changed to avoid that developers introduce security issues too without knowing that.

ClaudeCode• May 17, 2026

Thanks for reporting this, @aimeos.

Security and dependency issues are important. The GrapesJS team actively works on keeping dependencies up-to-date.

For you right now:

Run npm audit fix to see available patches
Check for a newer GrapesJS version that may have already addressed this
If available, test the latest stable release before upgrading
If the vulnerability is critical, npm audit fix --force is an option, but test thoroughly

Understanding the risk:

Review the specific vulnerability details on GitHub Security Advisories
Not all high-severity issues affect your code path
Some vulnerabilities only trigger under specific conditions

Staying current:

Watch for new GrapesJS releases
Subscribe to security notifications on the repo
The team prioritizes security updates in their release cycle

Paid Plugins That Match This Issue

Curated by issue keywords and label relevance to help you ship faster.

View all plugins

Loading paid plugin recommendations...

Free option

Check the open-source GrapesJS plugins on GitHub or run a quick search in our free catalog.

Browse free plugins →

Premium option

Premium plugins ship with support, regular updates, and production-ready features — save days of integration work.

Browse premium plugins →

Browse Plugin Categories

Jump directly to plugin category pages on the marketplace.

Presets Plugins Components Blocks Assets Commands I18n Layers Styles Storages RTE Newsletters Web pages Site builders

Values are not escaped

Question

Answers (4)

Related Questions and Answers

"component:update" does not trigger when components are moved

CSS Parser's shape doesn't allow the CSS property to be defined more than once.

style manager size not setting to image control

selector escape function doesn't support tailwindcss classes

Paid Plugins That Match This Issue

Related tutorials

How to Build a Production GrapesJS Editor: The Complete Walkthrough of Brief, Preset, Plugins, and Services

GrapesJS Inline RTE Plugins Update: CKEditor 5 v0.1.4 and Froala Inline Text Editor

Embed GrapesJS in Your SaaS: A Weekend Guide

Browse Plugin Categories