PT-2025-7555 · Unknown · Ckeditor 5

Mgsy · Published 2025-02-20 · Updated 2025-03-03 · CVE-2025-25299

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 44.2.1

Description A Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package, affecting user markers that represent users' positions within the document. This can lead to unauthorized JavaScript code execution with a very specific editor and token endpoint configuration. The vulnerability affects only installations with Real-time collaborative editing enabled.

Recommendations For versions prior to 44.2.1, update to version 44.2.1 or later to resolve the issue. As a temporary workaround, consider disabling the Real-time collaborative editing feature until the update is applied. Restrict access to the vulnerable user markers to minimize the risk of exploitation. Avoid using specific endpoint configurations that may trigger the vulnerability until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-25299

GHSA-J3MM-WMFM-MWVH

Affected Products

Ckeditor 5

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25299.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-25299 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-25299 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-25299 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3mm-wmfm-mwvh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-25299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25299 · Security Note
• https://github.com/ckeditor/ckeditor5 · Note
• https://github.com/ckeditor/ckeditor5/releases/tag/v44.2.1 · Note
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh · Note
• https://twitter.com/WolfgangSesin/status/1892690089139933445 · Twitter Post
• https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dca024c9b4e44aef039f99ebe6c664 · Note
• https://twitter.com/CVEnew/status/1892659716288925890 · Twitter Post
• https://t.me/cvedetector/18602 · Telegram Post