p PatchFirst

PatchFirst · Latest vulnerabilities

@ckeditor/ckeditor5-html-embed vulnerabilities

Vulnerabilities published for @ckeditor/ckeditor5-html-embed in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2022-31175

    Medium · CVSS 5.8EPSS 0.88%Fix available

    Cross-site scripting caused by the editor instance destroying process in ckeditor5

    CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying t

    @ckeditor/ckeditor5-html-embedNode.js
    • Update to 35.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →