CVE-2019-20903: Atlassian Editor-Core

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

Affected products

• Atlassian Editor-Core: before 113.1.5 (fixed in 113.1.5)

Published 2020-10-01. Last modified 2026-06-17.