GHSA-rh54-vffm-5fvp: XSS
Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values.
The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.
Patches The problem has been recognized and patched. The fix will be available in version 48.5.1 (and above) and 47.7.4 (LTS).
For more information Email us at security@cksource.com if you have any questions or comments about this advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@ckeditor/ckeditor5-engineto a version that resolves this vulnerability.Fixed in 48.5.1 - Upgrade
Upgrade
npm/ckeditor5to a version that resolves this vulnerability.Fixed in 48.5.1 - Upgrade
Upgrade
npm/@ckeditor/ckeditor5-engineto a version that resolves this vulnerability.Fixed in 47.7.4 - Upgrade
Upgrade
npm/ckeditor5to a version that resolves this vulnerability.Fixed in 47.7.4 - Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 48.5.1 - Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 47.7.4
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs the editor to process incoming style attribute values. Successful exploitation can result in unauthorized JavaScript execution through the XSS vulnerability.
Which CKEditor 5 releases contain the fix?
The fix is available in CKEditor 5 version 48.5.1 and later, and in 47.7.4 for the LTS release line.
Which packages should be reviewed for exposure?
Review deployments using the npm packages @ckeditor/ckeditor5-engine and ckeditor5, particularly where the editor processes incoming style attribute values.