CVE-2025-58064: CKEditor 5 Clipboard Package XSS Vulnerability
Summary
CVE-2025-58064: CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package. Affects ckeditor5 across 2 version ranges.
>= 44.2.0, < 45.2.2
>= 46.0.0, < 46.0.3
Fixed in 45.2.2 or 46.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 5 is a powerful rich text editor that enables users to create and edit content in a user-friendly interface. It supports various features such as inline editing, collaborative editing, and extensive plugin architecture. The clipboard package is responsible for handling clipboard operations, allowing users to copy and paste content seamlessly. However, a vulnerability has been identified in this package that could lead to cross-site scripting (XSS) attacks under specific configurations.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability exists in the CKEditor 5 clipboard package, which can be exploited through specific user actions. If an attacker manages to insert malicious content into the editor, it could lead to unauthorized execution of JavaScript code. This vulnerability is particularly concerning for installations where the HTML embed plugin is enabled or where a custom plugin introduces editable elements implementing the RawElement view. The potential ramifications include data theft, session hijacking, and other malicious activities.
How To Fix
Latest published version: 49.0.0 as of 23 Oct 2026
npm install ckeditor5@49.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 44.2.0, < 45.2.245.2.2npm install ckeditor5@45.2.2 -
>= 46.0.0, < 46.0.346.0.3npm install ckeditor5@46.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling the HTML embed plugin or any custom plugins that introduce editable elements implementing the RawElement view until the packages can be updated.
Conclusion
The CKEditor 5 clipboard package has a critical XSS vulnerability that can be exploited under certain conditions. It is essential for users to update their packages to the latest patched versions to mitigate the risks associated with this vulnerability. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ckeditor5 →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that can allow unauthorized JavaScript execution if malicious content is inserted into the editor.
Only installations of CKEditor 5 that have specific configurations, such as the HTML embed plugin enabled or custom plugins that introduce editable elements, are affected.
The potential impacts include data theft, session hijacking, and the execution of malicious scripts, which can compromise user security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider disabling the vulnerable features or plugins as a temporary measure until you can apply the necessary patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor5.
