CVE-2024-45613
Description
CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.
How to fix
- ckeditor ckeditor543.1.1 or later
- ckeditor543.1.1 or later
- @ckeditor/ckeditor5-clipboard43.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ckeditor ckeditor5 | 40.0.0 ≤ v < 43.1.1 | 43.1.1 |
| ckeditor5npm | 40.0.0 ≤ v < 43.1.1 | 43.1.1 |
| @ckeditor/ckeditor5-clipboardnpm | 40.0.0 ≤ v < 43.1.1 | 43.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.