CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

2read-ckeditor5-custom-build (>=25.0.0, <=25.1.2), @8trhieu/ckeditor5-build-classic-custom (>=0.0.1, <=0.0.5) +213 more potentially affected by CVE-2022-31175 via @ckeditor/ckeditor5-html-embed (>=0.0.0-internal-20241017.0, <=34.2.0)

@ckeditor/ckeditor5-html-embed NPM version =0.0.0-internal-20241017.0, =25.0.0, =0.0.1, =1.0.7, =34.1.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0,...

@8trhieu/ckeditor5-build-classic-custom (>=0.0.1, <=0.0.5), @ainhu8596/tee-mee-ckeditor (>=29.1.1, <=29.1.2) +201 more potentially affected by CVE-2022-31175 via @ckeditor/ckeditor5-markdown-gfm (>=0.0.0-internal-20241017.0, <=34.2.0)

@ckeditor/ckeditor5-markdown-gfm NPM version =0.0.0-internal-20241017.0, =0.0.1, =29.1.1, =1.0.0, =1.0.1, =34.1.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0,...

PT-2022-20587

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 35.0.1 Description A cross-site scripting issue has been discovered in CKEditor 5, affecting three optional packages: @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and...

CVE-2022-31175: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @arslanshahab/ckeditor5-build-classic (25.0.0) +232 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-media-embed (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-media-embed NPM version =0.0.0-internal-20241017.0, =2.1.1, =1.0.1, =0.25.0, =0.0.1, =0.0.1, =0.25.1, =25.0.1, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-nightly-next-20260105.0 and more Source cves: CVE-2021-21391 Source advisor...

2read-ckeditor5-custom-build (>=19.0.0, <=25.1.2), @accredify/custom_ckeditor (>=1.0.0, <=1.0.5) +476 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-widget (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-widget NPM version =0.0.0-internal-20241017.0, =19.0.0, =1.0.0, =2.1.1, =23.1.0, =1.0.0, =1.0.2, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =2.0.0, =0.0.6, =0.0.1, =0.0.1, =11.0.0 and more Source cves: CVE-2021-21391 Source advisory: MEND:CVE-2021-21391...

2read-ckeditor5-custom-build (>=19.0.0, <=25.1.2), @42ndstudio/ckeditor5-build-inline-custom (>=21.0.0, <=21.0.4) +365 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-font (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-font NPM version =0.0.0-internal-20241017.0, =19.0.0, =21.0.0, =24.0.0, =1.0.0, =15.0.1, =1.0.0, =1.0.0, =0.1.0, =1.0.1, =0.1.0, =19.0.0, =24.0.1 - @c0rtex/ckeditor5-ckfinder 1.0.0 - @c0rtex/ckeditor5-ckfinder-video 1.0.0 and more Source cves: CVE-2021-21391 Source advisory:...

CVE-2021-21391

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

@avocalix/avocalix-ckeditor5 (>=1.0.1, <=1.13.0), @ckeditor/ckeditor5-adapter-ckfinder (>=0.0.0-internal-20241017.0, <=0.0.0-nightly-next-20260105.0) +146 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-markdown-gfm (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-markdown-gfm NPM version =0.0.0-internal-20241017.0, =1.0.1, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0,...

@accredify/custom_ckeditor (>=1.0.0, <=1.0.5), @ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0) +307 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-image (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-image NPM version =0.0.0-internal-20241017.0, =1.0.0, =2.1.1, =23.1.0, =2.0.0, =1.0.0, =11.0.0, =0.25.0, =0.0.1, =0.0.1, =0.25.1, =25.0.1, =25.0.4 and more Source cves: CVE-2021-21391 Source advisory: MEND:CVE-2021-21391...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @arslanshahab/ckeditor5-build-classic (25.0.0) +291 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-list (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-list NPM version =0.0.0-internal-20241017.0, =2.1.1, =1.0.1, =0.25.0, =0.0.1, =0.0.1, =0.25.1, =25.0.1, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.5.1 and more Source cves: CVE-2021-21391 Source advisory:...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @arslanshahab/ckeditor5-build-classic (25.0.0) +230 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-paste-from-office (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-paste-from-office NPM version =0.0.0-internal-20241017.0, =2.1.1, =1.0.1, =0.25.0, =0.0.1, =0.0.1, =0.25.1, =25.0.1, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-nightly-next-20260105.0 and more Source...

2read-ckeditor5-custom-build (>=19.0.0, <=25.1.2), @42ndstudio/ckeditor5-build-inline-custom (>=21.0.0, <=21.0.4) +951 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-engine (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-engine NPM version =0.0.0-internal-20241017.0, =19.0.0, =21.0.0, =24.0.0, =1.0.0, =1.0.0, =2.1.1, =18.0.1, =18.0.1, =1.0.0, =24.0.0, =23.1.0, =1.0.0, =1.0.2, =10.1.2 and more Source cves: CVE-2021-21391 Source advisory: MEND:CVE-2021-21391...

CVE-2021-21391: Uncontrolled Resource Consumption

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

Regular Expression Denial Of Service (ReDoS)

ckeditor5 is vulnerable to regular expression denial of service. An attacker is able to exploit the vulnerability and crash the system by submitting a malicious html code via the parse.js function...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @ayomide-young/ckeditor5-build-classic-inline (26.0.0) +38 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-list (26.0.0)

@ckeditor/ckeditor5-list NPM version 26.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ckeditor/ckeditor5-list and may be impacted: - @ace-rbk/ckeditor-build-full-options =2.1.1, =1.0.0, =1.0.31 and more Source cves: CVE-2021-21391 Source advisor...

@mikaleb/ckeditor-nuxt (0.7.0), @mikaleb/ckeditor5-build-classic (26.0.0) potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-markdown-gfm (26.0.0)

@ckeditor/ckeditor5-markdown-gfm NPM version 26.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ckeditor/ckeditor5-markdown-gfm and may be impacted: - @mikaleb/ckeditor-nuxt 0.7.0 - @mikaleb/ckeditor5-build-classic 26.0.0 Source cves: CVE-2021-213...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @aeness/ckeditor5-insert-image (26.0.1) +36 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-image (26.0.0)

@ckeditor/ckeditor5-image NPM version 26.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ckeditor/ckeditor5-image and may be impacted: - @ace-rbk/ckeditor-build-full-options =2.1.1, =1.0.0, =26.0.0, =26.0.0, =1.0.0, =1.0.1 and more Source cves:...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @aeness/ckeditor5-build (26.0.0) +100 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-widget (26.0.0)

@ckeditor/ckeditor5-widget NPM version 26.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @ckeditor/ckeditor5-widget and may be impacted: - @ace-rbk/ckeditor-build-full-options =2.1.1, =0.0.1, =0.0.6 - @ayomide-young/ckeditor5-build-classic-inline...