CVE-2018-11093: Cross-Site Scripting in @ckeditor/ckeditor5-link
Summary
CVE-2018-11093: Cross-Site Scripting in @ckeditor/ckeditor5-link. Affects @ckeditor/ckeditor5-link versions >= 0.3.0, < 10.0.1. Fixed in 10.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ckeditor/ckeditor5-link package is an npm package that provides functionality for creating and managing links in CKEditor 5, a powerful and customizable rich text editor. It allows users to insert and edit hyperlinks in their content. However, versions prior to 10.0.1 of this package are vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in @ckeditor/ckeditor5-link arises from the failure to properly sanitize the 'href' attribute of a created '<a>' tag in the '_createPreviewButton()' function. This allows an attacker to inject and execute arbitrary JavaScript code in a victim's browser. The impact of this vulnerability can range from unauthorized data access to complete control over the victim's session.
How To Fix
Minimum fixed version
10.0.1
This is the first release that contains the fix.
npm install @ckeditor/ckeditor5-link@10.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the @ckeditor/ckeditor5-link package to the fixed version to mitigate the risk of XSS attacks.
Conclusion
The Cross-Site Scripting vulnerability in the @ckeditor/ckeditor5-link package can have severe security implications for applications using CKEditor 5. It is crucial to upgrade to version 10.0.1 or later to mitigate the risk of XSS attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @ckeditor/ckeditor5-link →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It occurs when a web application does not properly validate and sanitize user input, allowing the execution of arbitrary code in the victim's browser.
An attacker can exploit this vulnerability by crafting a malicious link that contains JavaScript code in the 'href' attribute. When a user clicks on the link, the code will be executed in their browser, potentially leading to unauthorized actions or data theft.
The consequences of this vulnerability can vary depending on the attacker's intentions and the security context of the affected application. Possible outcomes include unauthorized access to sensitive data, session hijacking, defacement of web pages, and the injection of malicious content.
While there is no specific known exploit for this vulnerability in the public domain, it is a well-known and documented type of vulnerability. It is crucial to address it promptly to prevent potential attacks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file, without requiring access to the code or installation.
