CKEditor 5 General HTML Support Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in CKEditor 5 versions prior to 47.6.0, within the General HTML Support feature. This issue arises when an editor instance is configured to allow unsafe markup, enabling the execution of unauthorized JavaScript code. The vulnerability can be exploited by inserting specially crafted markup, but only if the General HTML Support feature is enabled and configured to accept unsafe content.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update CKEditor 5 to version 47.6.0 or later to address this vulnerability. For those using the General HTML Support feature, it is recommended to configure it securely to prevent the acceptance of unsafe content.