Executive brief
CKEditor 5 is a popular rich-text editor used in web applications to allow users to create and edit documents. A cross-site scripting (XSS) vulnerability in its real-time collaboration feature allows attackers to inject malicious JavaScript code that executes in users' browsers, potentially leading to session hijacking, credential theft, or unauthorized document manipulation. The vulnerability only affects systems with real-time collaborative editing enabled.
Technical details
A cross-site scripting (XSS) vulnerability exists in the CKEditor 5 real-time collaboration package, specifically affecting the handling of user markers that represent user positions within shared documents. The vulnerability stems from improper neutralization of script-related HTML tags (CWE-80), allowing attackers to inject malicious JavaScript through document markers. Attack vectors include network-based exploitation without authentication or user interaction required. An attacker can execute arbitrary JavaScript in the context of collaborative editing sessions. The vulnerability is patched in version 44.2.1 and above for both the @ckeditor/ckeditor5-real-time-collaboration package (v41.3.0–v44.2.0 affected) and ckeditor5-premium-features package (v42.0.0–v44.2.0 affected).
Affected products
- CKEditor CKEditor 5 v41.3.0 to v44.2.0
Timeline
- 2025-02-20: disclosed: Vulnerability disclosed via GHSA-j3mm-wmfm-mwvh and CVE-2025-25299
- 2025-02-20: patched: Patched in version 44.2.1 and above