CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Published 21 Aug 2024 · Updated 18 Nov 2024
Affected package
- Affected
- >=4.22.0 <4.25.0
- Fixed in
- 4.25.0
npm install ckeditor4@4.25.0Details
Affected Packages
The issue impacts only editor instances with enabled version notifications.
Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please [contact us](mailto:security@cksource.com).
Impact
A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices.
Patches
The issue has been recognized and patched. The fix is available in version 4.25.0-lts.
For More Information
If you have any questions or comments about this advisory, please email us at [security@cksource.com](mailto:security@cksource.com).
Is GHSA-6v96-m24v-f58j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected ckeditor4, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.