| Package | Affected versions | Patched versions |
|---|---|---|
| ckeditor5 | < 25.0.0 | 25.0.0 |
| @ckeditor/ckeditor5-markdown-gfm | < 25.0.0 | 25.0.0 |
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0.
The problem has been recognized and patched. The fix will be available in version 25.0.0.
The user can work around the issue by:
If you have any questions or comments about this advisory:
The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and Alvaro Muñoz from GitHub for reporting it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free