CKEditor 44.2.0 < 45.2.2, 46.0.0 < 46.0.3 XSS Vulnerability

CKEditor 5 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2025-57833 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...

CVE-2025-58064

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

CVE-2025-58064

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

CKEditor 5 跨站脚本漏洞

CKEditor 5 is a text editor from the CKEditor Ecosystem open source. A cross-site scripting vulnerability exists in CKEditor 5 versions 46.0.0 to 46.0.2 and 44.2.0 to 45.2.1, which stems from a vulnerability that could be triggered by a specific user action and lead to unauthorized JavaScript cod...

CVE-2025-58064: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

@_sh/strapi-plugin-ckeditor (>=5.0.0, <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0, <=0.10.2) +132 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0, <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0 and more Source cves: CVE-2025-58064 Source advisory: SNYK:JS-CKEDITORCKEDITOR5CLIPBOARD-12485153...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.2 and more Source cves: CVE-2025-58064 Source advisory: SNYK:JS-CKEDITORCKEDITOR5CLIPBOARD-12485153...

CVE-2025-58064

Summary: CKEditor 5 (ckeditor5 and ckeditor5-clipboard) has an XSS vulnerability in certain clipboard-related configurations. Vulnerable versions are 46.0.0–46.0.2 and 44.2.0–45.2.1; exploitation requires a specific user action and a particularly configured editor. The issue arises when the HTML ...

CVE-2025-58064 CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

@_sh/strapi-plugin-ckeditor (>=5.0.0, <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0, <=0.10.2) +132 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0, <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0 and more Source cves: CVE-2025-58064 Source advisory: MEND:CVE-2025-58064...

CVE-2025-58064 CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.2 and more Source cves: CVE-2025-58064 Source advisory: MEND:CVE-2025-58064...

CVE-2025-58064

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

@_sh/strapi-plugin-ckeditor (>=5.0.0, <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0, <=0.10.2) +132 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0, <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0 and more Source cves: CVE-2025-58064 Source advisory: OSV:GHSA-X9GP-VJH6-3WV6...

@_sh/strapi-plugin-ckeditor (>=5.0.0, <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0, <=0.10.2) +132 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0, <=45.2.1)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.2.0, =44.3.0 and more Source cves: CVE-2025-58064 Source advisory: GHSA-X9GP-VJH6-3WV6...

CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which...

GHSA-X9GP-VJH6-3WV6 CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.2 and more Source cves: CVE-2025-58064 Source advisory: OSV:GHSA-X9GP-VJH6-3WV6...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.0, =46.0.2 and more Source cves: CVE-2025-58064 Source advisory: GHSA-X9GP-VJH6-3WV6...