@portabletext/editor is vulnerable to Denial of Service (DoS)
53
Medium Risk
The @portabletext/editor package can enter unbounded recursion that overflows the JavaScript call stack and leaves the editor blank until reload. The preventOverlappingAnnotations core behavior raises an annotation.remove followed by the original annotation.add whenever its guard reports the annotation active, but the guard and the remove operation can resolve the effective selection differently, so the remove strips nothing while the guard keeps reporting active and the raise chain never terminates. Concurrent remote patches routinely create the stale or boundary-touching selections that drive this cycle, and a related isActiveAnnotation 'partial' mode flaw reports activity for selections that cover no annotated text. The fix aligns the guard's selection resolution with the remove operation, requires covered text for 'partial' activity, and depth-limits behavior event chains so cycles fail with a console error instead of overflowing the stack.
You are affected if you are using a version that falls within the vulnerable range and the editor processes concurrent or remote patch updates such as those produced by collaborative editing.
@portabletext/editor is vulnerable to Denial of Service (DoS) in versions 4.3.0 - 7.10.8.
Upgrade the @portabletext/editor library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant