PT-2025-36639 · Npm · @Ckeditor/Ckeditor5-Clipboard+1

Publicado 2025-09-03 · Atualizado 2025-09-03

OSV

CVSS v4.0

2.3

Baixa

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.

This vulnerability affects only installations where the editor configuration meets one of the following criteria:

• HTML embed plugin is enabled
• Custom plugin introducing editable element which implements view [RawElement](https://ckeditor.com/docs/ckeditor5/latest/api/module engine view rawelement-ViewRawElement.html) is enabled

Patches

The problem has been recognized and patched. The fix will be available in version 46.0.3 (and above), and explicitly in version 45.2.2.

For more information

Email us at [e-mail] if you have any questions or comments about this advisory.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

GHSA-X9GP-VJH6-3WV6

Produtos afetados

@Ckeditor/Ckeditor5-Clipboard

Ckeditor 5

Referências · 5

• https://github.com/ckeditor/ckeditor5 · Nota
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-x9gp-vjh6-3wv6 · Nota
• https://github.com/ckeditor/ckeditor5/commit/b210e90c6cf84e662ef6c7daf93a92355a961bf2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-58064 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-x9gp-vjh6-3wv6 · Aviso do Fabricante