Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

ckeditor5-premium-features

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9npmAmendedPublished

    Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package

    CVE-2025-25299 · GHSA-j3mm-wmfm-mwvh

    Affected
    • npm ckeditor5-premium-features >= 42.0.0, < 44.2.1
    Fixed in
    44.2.1· Vendor fix available
    Issue
    Impact During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document. This vulnerability affects only installations with Real-time collaborative editing enabled. Patches The problem has been recognized and patched. The fix will be available in version 44.2.1 (and above). For more information Email us at security@cksource.com if you have any questions or comments about this advisory.

    Recommended action: Upgrade to 44.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →