PT-2025-35839 · Ckeditor · Ckeditor 5+1

Mgsy · Published 2025-09-03 · Updated 2025-09-04 · CVE-2025-58064

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions ckeditor5 versions 44.2.0 through 45.2.1 ckeditor5 versions 46.0.0 through 46.0.2 ckeditor5-clipboard versions 44.2.0 through 45.2.1 ckeditor5-clipboard versions 46.0.0 through 46.0.2

Description CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. The software contains a Cross-Site Scripting (XSS) vulnerability. Exploitation could lead to unauthorized JavaScript code execution if an attacker inserts malicious content into the editor, potentially occurring with a specific editor configuration. This issue affects installations where the HTML embed plugin is enabled, or a custom plugin introduces an editable element where view RawElement is enabled.

Recommendations Update to ckeditor5 version 45.2.2 or later. Update to ckeditor5-clipboard version 45.2.2 or later. Update to ckeditor5 version 46.0.3 or later. Update to ckeditor5-clipboard version 46.0.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-58064

GHSA-X9GP-VJH6-3WV6

Affected Products

Ckeditor 5

Ckeditor5-Clipboard

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58064.json · Exploit
• https://osv.dev/vulnerability/GHSA-x9gp-vjh6-3wv6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58064 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58064 · Vendor Advisory
• https://github.com/ckeditor/ckeditor5 · Note
• https://github.com/ckeditor/ckeditor5/commit/b210e90c6cf84e662ef6c7daf93a92355a961bf2 · Note
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-x9gp-vjh6-3wv6 · Note
• https://t.me/CVEtracker/31645 · Telegram Post
• https://twitter.com/CVEnew/status/1963369440562524325 · Twitter Post