npm/@ckeditor/ckeditor5-html-support CVE-2022-31175: medium 5.8, EPSS 0.88%
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process
Action: Upgrade @ckeditor/ckeditor5-html-support to 35.0.1 or later.
npm i @ckeditor/ckeditor5-html-support@35.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 35.0.1 | - |
Fixed versions
| 35.0.1 |
Sources
- osv: GHSA-42wq-rch8-6f6j#npm/@ckeditor/ckeditor5-html-support
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j
- https://nvd.nist.gov/vuln/detail/CVE-2022-31175
- https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html
- https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html
- https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html
- https://github.com/ckeditor/ckeditor5
CVE-2022-31175 · published · modified · JSON