Description
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `
Remediation
References
https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html
https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html
https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j
Related Vulnerabilities
CVE-2017-4963 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-common
CVE-2023-25330 Vulnerability in maven package com.baomidou:mybatis-plus-extension
CVE-2018-15685 Vulnerability in maven package org.webjars.npm:electron
CVE-2015-8854 Vulnerability in maven package org.webjars:marked
CVE-2023-1584 Vulnerability in maven package io.quarkus:quarkus-oidc