Executive brief
CKEditor's link module contains a cross-site scripting (XSS) vulnerability in its link preview feature. An attacker can inject malicious JavaScript code through a crafted link, which executes when a user views the link preview in the editor. This could allow attackers to steal sensitive data from the editor or perform actions on behalf of the user within the editing application.
Technical details
The vulnerability is a DOM-based cross-site scripting (CWE-79) flaw in the _createPreviewButton() function of @ckeditor/ckeditor5-link versions prior to 10.0.1. The function fails to sanitize the href attribute when creating an anchor tag for the link preview, allowing arbitrary HTML/JavaScript injection. The attack vector is network-based and requires user interaction (viewing a crafted link preview). An attacker can inject JavaScript via a malicious href attribute that executes in the victim's browser context. The fix involves sanitizing the href attribute using an ensureSafeUrl utility function; the patch is available in version 10.0.1 and later.
Affected products
- CKEditor ckeditor5-link 0.3.0 before 10.0.1
Timeline
- 2018-05-23: disclosed
- 2018-05-22: patched: Fix committed to repository