GHSA-j3mm-wmfm-mwvh

Suggest an improvement
Source
https://github.com/advisories/GHSA-j3mm-wmfm-mwvh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j3mm-wmfm-mwvh
Aliases
Published
2025-02-20T20:16:31Z
Modified
2025-02-20T22:53:45Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package
Details

Impact

During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.

This vulnerability affects only installations with Real-time collaborative editing enabled.

Patches

The problem has been recognized and patched. The fix will be available in version 44.2.1 (and above).

For more information

Email us at security@cksource.com if you have any questions or comments about this advisory.

Database specific 
{
    "cwe_ids":  [
        "CWE-79",
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-20T20:16:31Z",
    "nvd_published_at":  "2025-02-20T20:15:46Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / @ckeditor/ckeditor5-real-time-collaboration

Package

Name
@ckeditor/ckeditor5-real-time-collaboration
View open source insights on deps.dev
Purl
pkg:npm/%40ckeditor/ckeditor5-real-time-collaboration

Affected ranges

Type
SEMVER
Events
Introduced
41.3.0
Fixed
44.2.1

Database specific

last_known_affected_version_range 
"<= 44.2.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json"

npm / ckeditor5-premium-features

Package

Name
ckeditor5-premium-features
View open source insights on deps.dev
Purl
pkg:npm/ckeditor5-premium-features

Affected ranges

Type
SEMVER
Events
Introduced
42.0.0
Fixed
44.2.1

Database specific

last_known_affected_version_range 
"< 44.2.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json"