registry / @dufy_asesorias/react-contenido-enriquecido / 1.0.14

@dufy_asesorias/react-contenido-enriquecido@1.0.14

### 1. ¿Cómo es la estructura del `contenido`? Este componente no acepta texto simple. Utiliza el formato Delta de Quill (un array de operaciones). Aquí tienes un ejemplo de cómo estructurar los datos que le pases:

AI Security Review

scanned 9h ago · by lpm-firewall-ai

A consumer that renders attacker-controlled rich-content data can execute injected HTML/JavaScript in the browser. The editor also loads Quill from its documented CDN only when editing is opened.

Static reason

No blocking static signals were detected.

Trigger

Render untrusted `contenido`, or an authorized user opens the editor.

Impact

Stored cross-site scripting in the consuming application; CDN compromise could execute code in editing sessions.

Mechanism

Unsanitized HTML interpolation and runtime third-party script injection.

Rationale

Source inspection found no install-time or stealthy malicious behavior. It does contain a concrete browser XSS vulnerability and a user-triggered remote-script dependency, so it should be warned rather than blocked.

Evidence

package.jsondist/index.es.jsindex.d.tsREADME.md

Network endpoints2

cdn.quilljs.com/1.3.6/quill.snow.csscdn.quilljs.com/1.3.6/quill.min.js

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Critical Vulnerability with low false-positive risk.

@dufy_asesorias/react-contenido-enriquecido@1.0.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code