CKEditor: Cross-site scripting (XSS) in the engine package
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 47.7.4, 48.5.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CKEditor 5's engine package, a JavaScript rich-text editor, is affected by this cross-site scripting vulnerability. Crafted editor content can trigger unauthorized JavaScript execution in a user's browser.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ckeditor ckeditor5
From 45.0.0 · fixed in 47.7.4; From 48.0.0 · fixed in 48.5.1
- ckeditor5npm
From 45.0.0 · fixed in 47.7.4
- @ckeditor/ckeditor5-enginenpm
From 45.0.0 · fixed in 47.7.4
- ckeditor5npm
From 48.0.0 · fixed in 48.5.1
- @ckeditor/ckeditor5-enginenpm
From 48.0.0 · fixed in 48.5.1