CVE-2024-45613

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.

• CWE-79

• https://github.com/ckeditor/ckeditor5/releases/tag/v43.1.1Release Notes
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rgg8-g5x8-wr9vThird Party Advisory

Published

Sep 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45608GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-45609GLPI is a Free Asset and IT Management Software package, Dat…6.1
• CVE-2024-4561 In WhatsUp Gold versions released before 2023.1.2 , a bli…5.3
• CVE-2024-45610GLPI is an open-source asset and IT management software pack…6.1
• CVE-2024-45611GLPI is an open-source asset and IT management software pack…5.4
• CVE-2024-45612Contao is an Open Source CMS. In affected versions an untrus…5.3
• CVE-2024-45614Puma is a Ruby/Rack web server built for parallelism. In aff…5.4
• CVE-2024-45615A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45616A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45617A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
• CVE-2024-45618A vulnerability was found in pkcs15-init in OpenSC. An attac…3.9
• CVE-2024-45619A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…4.3