PT-2025-36639 · Npm · @Ckeditor/Ckeditor5-Clipboard+1

Published 2025-09-03 · Updated 2025-09-03

OSV

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.

This vulnerability affects only installations where the editor configuration meets one of the following criteria:

• HTML embed plugin is enabled
• Custom plugin introducing editable element which implements view [RawElement](https://ckeditor.com/docs/ckeditor5/latest/api/module engine view rawelement-ViewRawElement.html) is enabled

Patches

The problem has been recognized and patched. The fix will be available in version 46.0.3 (and above), and explicitly in version 45.2.2.

For more information

Email us at [e-mail] if you have any questions or comments about this advisory.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-X9GP-VJH6-3WV6

Affected Products

@Ckeditor/Ckeditor5-Clipboard

Ckeditor 5

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58064 · Security Note
• https://osv.dev/vulnerability/GHSA-x9gp-vjh6-3wv6 · Vendor Advisory
• https://github.com/ckeditor/ckeditor5 · Note
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-x9gp-vjh6-3wv6 · Note
• https://github.com/ckeditor/ckeditor5/commit/b210e90c6cf84e662ef6c7daf93a92355a961bf2 · Note