CKEditor 5 v49.0.1 is now available.
Release highlights
This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.
The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.
The second vulnerability (GHSA-xh7q-269v-94j2) affects the "Preview final content" feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.
The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.
You can read more details in the relevant security advisories and contact us if you have more questions.
We would like to thank Won Yong Jeon for reporting these vulnerabilities.
Other changes
- track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
Released packages (summary)