Homepage

org.webjars.npm:ckeditor5@36.0.0

  • latest version

    47.3.0

  • first published

    4 years ago

  • latest version published

    9 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:ckeditor5 package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Cross-site Scripting (XSS)

    org.webjars.npm:ckeditor5 is an A set of ready-to-use rich text editors created with a powerful framework. Made with real-time collaborative editing in mind.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the _checkShouldRenderAttribute method in domconverter.ts, where the sanitization regex used to strip whitespace before checking for dangerous URI schemes (such as javascript: or data:image/svg) fails to account for null bytes and other control characters (U+0000–U+0020). An authenticated attacker can inject a payload containing these characters to bypass the attribute value filter and cause malicious script execution in the victim's browser.

    How to fix Cross-site Scripting (XSS)?

    Upgrade org.webjars.npm:ckeditor5 to version 47.7.4, 48.5.1 or higher.

    [29.0.0,47.7.4)[48.0.0,48.5.1)
    Go back to all versions of this package