CKEditor 5 v47.7.4 is now available.
ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.
Release highlights
This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.
The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.
The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
You can read more details in the relevant security advisories and contact us if you have more questions.
Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.
Bug fixes
- engine: Improved
data:URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addressesGHSA-v6mg-96c6-gmpq.
Other changes
- Updated the
es-toolkitdependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described inGHSA-rh54-vffm-5fvp.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
Released packages (summary)