Executive brief
CKEditor5 is a rich text editor used to build content editing capabilities into websites and applications. A cross-site scripting (XSS) vulnerability in the HTML embed feature allows attackers to inject malicious scripts that execute in users' browsers when they view or interact with edited content. This could lead to account compromise, credential theft, or malware distribution to website visitors.
Technical details
CKEditor5 versions up to 35.4.0 contain a stored XSS vulnerability in the HTML embed feature (htmlEmbed plugin). The vulnerability arises from insufficient input sanitization when processing embedded HTML content, allowing an attacker to inject arbitrary scripts. The attack requires user interaction (opening a document with malicious embedded HTML) but does not require authentication. While the vendor notes that integrators can configure security settings and safe defaults exist (e.g., config.htmlEmbed.showPreviews defaults to false), deployments with permissive settings remain vulnerable. The issue is fixed in version 36.0.0 and later.
Affected products
- CKSource CKEditor5 before 36.0.0
Timeline
- 2023-02-13: disclosed: Published in OSV as GHSA-6p89-3p7c-qrhv
- 2023-02-15: patched: Note withdrawn 2023-02-15 per vendor statement; fix available in 36.0.0
- 2022: other: CVE-2022-48110 assigned