Description
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `
Remediation
References
https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html
https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html
https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j
Related Vulnerabilities
CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-api
CVE-2020-1957 Vulnerability in maven package org.apache.shiro:shiro-web
CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal
CVE-2014-7816 Vulnerability in maven package io.undertow:undertow-servlet
CVE-2016-8750 Vulnerability in maven package org.apache.karaf.jaas:org.apache.karaf.jaas.modules