Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@ckeditor/ckeditor5-list

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5npmAmendedPublished

    Regular expression Denial of Service in multiple packages

    CVE-2021-21391 · GHSA-3rh3-wfr4-76mj

    Affected
    • npm @ckeditor/ckeditor5-list <= 26.0.0
    Fixed in
    27.0.0· Vendor fix available
    Issue
    Impact A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. Patches The problem has been recognized and patched. The fix will be available in version 27.0.0. For more information Email us at security@cksource.com if you have any questions or comments about this advisory. Acknowledgements The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.

    Recommended action: Upgrade to 27.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →