Tóm tắt nhanh
- CVE-2025-58064 là lỗ hổng mức THẤP (CVSS 2.3) ảnh hưởng @ckeditor/ckeditor5-clipboard, ckeditor5.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 36.1% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 45.2.2, 46.0.3 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| @ckeditor/ckeditor5-clipboard npm | ≥ 44.2.0, < 45.2.2≥ 46.0.0, < 46.0.3
| 45.2.246.0.3
|
| ckeditor5 npm | ≥ 44.2.0, < 45.2.2≥ 46.0.0, < 46.0.3
| 45.2.246.0.3
|
Mô tả
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.
This vulnerability affects only installations where the editor configuration meets one of the following criteria:
Patches
The problem has been recognized and patched. The fix will be available in version 46.0.3 (and above), and explicitly in version 45.2.2.
For more information
Email us at [email protected] if you have any questions or comments about this advisory.
Mô tả của NVD
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered by a specific user action (leading to unauthorized JavaScript code execution) if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects installations where the editor configuration meets one of the following criteria: the HTML embed plugin is enabled, or there is a custom plugin introducing an editable element where view RawElement is enabled. This issue is fixed in versions 45.2.2 and 46.0.3 of both ckeditor5 and ckeditor5-clipboard.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí