GHSA-x9gp-vjh6-3wv6: CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-58064

CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

Low severity GitHub Reviewed Published Sep 3, 2025 in ckeditor/ckeditor5 • Updated Sep 3, 2025

Package

npm @ckeditor/ckeditor5-clipboard (npm)

Affected versions

>= 44.2.0, < 45.2.2

>= 46.0.0, < 46.0.3

Patched versions

45.2.2

46.0.3

>= 46.0.0, < 46.0.3

>= 44.2.0, < 45.2.2

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.

This vulnerability affects only installations where the editor configuration meets one of the following criteria:

• HTML embed plugin is enabled
• Custom plugin introducing editable element which implements view RawElement is enabled

Patches

The problem has been recognized and patched. The fix will be available in version 46.0.3 (and above), and explicitly in version 45.2.2.

For more information

Email us at security@cksource.com if you have any questions or comments about this advisory.

References

• GHSA-x9gp-vjh6-3wv6
• ckeditor/ckeditor5@b210e90

Published to the GitHub Advisory Database

Sep 3, 2025