The next generation Javascript WYSIWYG HTML rich text editor made by devs for devs. High performance and modern design make it easy to use for developers and loved by users.
58%
Total Score
caution
Usable with caveats: active registry releases are offset by a repository with no commits since August 2020.
The repository recorded zero commits and zero active maintainers in the last three months, despite 10 registry releases in the last year; this disconnect weakens source-maintenance confidence.
No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's established release history.
There were no new or merged pull requests and no issue activity in the last month, which provides little evidence of active source collaboration.
The linked repository has zero stars, forks, and watchers, offering no supporting evidence of external adoption or review; popularity is only supporting evidence, so this is a limited concern.
The repository reports no build tools and no security scanning tools, reducing evidence of repeatable builds and automated security hygiene.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10308 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. froala-editor is vulnerable to Dependency on Vulnerable Third-Party Component in versions 2.0.2 - 4.5.1. | 2.0.2 - 4.5.1 | Low |
CVE-2024-51434 froala-editor is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 4.3.0. | 0.0.0 - 4.3.0 | Medium |
AIKIDO-2024-10064 froala-editor is vulnerable to Cross-site Scripting (XSS) in versions 4.0.1 - 4.1.3. | 4.0.1 - 4.1.3 | Medium |
CVE-2019-19935 froala-editor is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.2.3. | 0.0.0 - 3.2.3 | Medium |
CVE-2020-22864 froala-editor is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 4.0.6. | 0.0.0 - 4.0.6 | Medium |
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.