What is GHSA-x9gp-vjh6-3wv6?

GHSA-x9gp-vjh6-3wv6 is a security advisory published by GitHub Security Advisories with Low severity. CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

Which CVE IDs does GHSA-x9gp-vjh6-3wv6 cover?

GHSA-x9gp-vjh6-3wv6 covers the following CVE IDs: CVE-2025-58064. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-x9gp-vjh6-3wv6?

GHSA-x9gp-vjh6-3wv6 affects 4 products, including: npm/ckeditor5:\u003e= 46.0.0, \u003c 46.0.3; npm/@ckeditor/ckeditor5-clipboard:\u003e= 44.2.0, \u003c 45.2.2; npm/ckeditor5:\u003e= 44.2.0, \u003c 45.2.2; npm/@ckeditor/ckeditor5-clipboard:\u003e= 46.0.0, \u003c 46.0.3.

GHSA-x9gp-vjh6-3wv6Low

CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

Vendor

GitHub Security Advisories

Published

September 3, 2025

Last Modified

September 4, 2025

🔗 CVE IDs covered (1)

CVE-2025-58064 →

📋 Description

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.

This vulnerability affects only installations where the editor configuration meets one of the following criteria:

HTML embed plugin is enabled
Custom plugin introducing editable element which implements view RawElement is enabled

Patches

The problem has been recognized and patched. The fix will be available in version 46.0.3 (and above), and explicitly in version 45.2.2.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

🎯 Affected products4

npm/ckeditor5:>= 46.0.0, < 46.0.3
npm/@ckeditor/ckeditor5-clipboard:>= 44.2.0, < 45.2.2
npm/ckeditor5:>= 44.2.0, < 45.2.2
npm/@ckeditor/ckeditor5-clipboard:>= 46.0.0, < 46.0.3