CVE-2025-58064: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

@_sh/strapi-plugin-ckeditor (>=5.0.0, <=6.0.1), @abcxyz123321555/ckeditor5-build-test-version (>=0.7.0, <=0.10.2) +132 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=44.2.0, <=45.2.1-alpha.10)

@ckeditor/ckeditor5-clipboard NPM version =44.2.0, =5.0.0, =0.7.0, =0.0.2, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.2.0-alpha.0, =44.3.0 and more Source cves:...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0-alpha.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0-alpha.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2-alpha.1)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0,...

@ckeditor/ckeditor5-adapter-ckfinder (>=46.0.0-alpha.0, <=46.0.2), @ckeditor/ckeditor5-ai (>=46.0.0-alpha.0, <=46.0.2) +89 more potentially affected by CVE-2025-58064 via @ckeditor/ckeditor5-clipboard (>=46.0.0, <=46.0.2-alpha.1)

@ckeditor/ckeditor5-clipboard NPM version =46.0.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0, =46.0.0-alpha.0,...