CVE-2022-31175

CKEditor 5 prior to 35.0.1 contains an XSS flaw in three optional packages: @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and @ckeditor/ckeditor5-html-embed. The vulnerability arises from a mechanism that updates the source element with markup from the data pipeline after de...

CVE-2021-21391

CVE-2021-21391 affects CKEditor 5 npm packages including ckeditor5-engine, -font, -image, -list, -markdown-gfm, -media-embed, -paste-from-office, and -widget. Root cause: a regular expression denial of service (ReDoS) vulnerability that can cause a significant performance drop and browser tab fre...