Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected packages The vulnerability has been discovered in Code Snippet GeSHi plugin. All integrators that use GeSHi syntax highlighter on the backend side can be affected. Impact A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. Patches The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to…
Recommended action: Upgrade to 4.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected packages The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that: Enabled full-page editing mode, or enabled CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements). Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. It affects all users using the CKEditor 4 at version < 4.24.0-lts. Patches The problem has been recognized and patched. The fix will be available in version 4.24.0-lts. For more information Email us at security@cksource.com if you have any questions or comments about this advisory. Acknowledgements The CKEditor 4 team would like to thank Michal Frýba from…
Recommended action: Upgrade to 4.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Recommended action: Upgrade to 4.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. Patches The problem has been recognized and patched. The fix will be available in version 4.17.0. For more information Email us at security@cksource.com if you have any questions or comments about this advisory. Acknowledgements The CKEditor 4 team would like to thank William Bowling (wbowling) for recognizing and reporting this vulnerability.
Recommended action: Upgrade to 4.17.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.