A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package (CVE-2025-58064). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.
This vulnerability affects only installations where the editor configuration meets one of the following criteria:
- HTML embed plugin is enabled
- Custom plugin introducing an editable element which implements view RawElement is enabled
You can read more details in the relevant security advisory and contact us if you have more questions.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
Released packages (summary)