Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This vulnerability affects only installations where the editor configuration meets the following criteria: General HTML Support is enabled, General HTML Support configuration allows inserting unsafe markup (see Security section to learn more). Patches The problem has been recognized and patched. The fix will be available in version 47.6.0 (and above). Workarounds CKEditor 5 recommends configuring General HTML Support securely to ensure that unsafe content is not accepted. Please refer to the Security section for detailed guidance. Credits CKEditor 5 would like to thank: - Emilio Kevin - Jeongwoo Lee, Younsoung Kim, Minseok Kim and Jinyeong Kim from ENKI Whitehat for responsibly…
Recommended action: Upgrade to 47.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions: a) Using one of the affected packages. In case of ckeditor5-html-support and ckeditor5-html-embed, additionally, it was required to use a configuration that allows unsafe markup inside the editor, b) Initializing the editor on an element and using an element other than <textarea as a base, c) Destroying the editor instance. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features.…
Recommended action: Upgrade to 35.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.