CVE-2025-58064

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered by a specific user action (leading to unauthorized JavaScript code execution) if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects installations where the editor configuration meets one of the following criteria: the HTML embed plugin is enabled, or there is a custom plugin introducing an editable element where view RawElement is enabled. This issue is fixed in versions 45.2.2 and 46.0.3 of both ckeditor5 and ckeditor5-clipboard.

• CWE-79

• https://github.com/ckeditor/ckeditor5/commit/b210e90c6cf84e662ef6c7daf93a92355a961bf2
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-x9gp-vjh6-3wv6

Published

Sep 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58059Valtimo is a platform for Business Process Automation. In ve…9.1
• CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling r…8
• CVE-2025-58060OpenPrinting CUPS is an open source printing system for Linu…8
• CVE-2025-58061OpenEBS Local PV RawFile allows dynamic deployment of Statef…5.5
• CVE-2025-58062LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp de…7.3
• CVE-2025-58063CoreDNS is a DNS server that chains plugins. Starting in ver…7.1
• CVE-2025-58065Flask-AppBuilder is an application development framework. Pr…6.5
• CVE-2025-58066nptd-rs is a tool for synchronizing your computer's clock, i…5.3
• CVE-2025-58067Basecamp's Google Sign-In adds Google sign-in to Rails appli…4.2
• CVE-2025-58068Eventlet is a concurrent networking library for Python. Prio…9.1
• CVE-2025-58069The use of a hard-coded cryptographic key was discovered in …6.9
• CVE-2025-5807The Gwolle Guestbook plugin for WordPress is vulnerable to S…6.1