npm/@ckeditor/ckeditor5-real-time-collaboration CVE-2025-25299: low 2.3, EPSS 0.60%

Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package

Action: Upgrade @ckeditor/ckeditor5-real-time-collaboration to 44.2.1 or later.

npm i @ckeditor/ckeditor5-real-time-collaboration@44.2.1

Affected

Fixed versions

Sources

• osv: GHSA-j3mm-wmfm-mwvh
• nvd: CVE-2025-25299
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh
• https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html
• https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dca024c9b4e44aef039f99ebe6c664
• https://github.com/ckeditor/ckeditor5
• https://github.com/ckeditor/ckeditor5/releases/tag/v44.2.1

CVE-2025-25299 · published 2025-02-20T20:16:31Z · modified 2025-02-20T22:53:45Z · JSON