CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered     affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to     trigger a JavaScript code after fulfilling special conditions. The affected packages are     `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-     embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-     support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows     unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an     element and using an element other than `<textarea>` as a base. The root cause of the issue was a     mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data     pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that     depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed     features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are     no known workarounds for this issue. (CVE-2022-31175)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered
    affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to
    trigger a JavaScript code after fulfilling special conditions. The affected packages are
    `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-
    embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-
    support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows
    unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an
    element and using an element other than `<textarea>` as a base. The root cause of the issue was a
    mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data
    pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that
    depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed
    features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are
    no known workarounds for this issue. (CVE-2022-31175)

According to its self-reported version number, the CKEditor application running on the remote host is prior to 5.35.0.1. It is, therefore, affected by a Cross-Site-Scripting after fulfilling special conditions.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 03bb8373-2026-11ed-9d70-080027240888 advisory.

  - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered     affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to     trigger a JavaScript code after fulfilling special conditions. The affected packages are     `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-     embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-     support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows     unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an     element and using an element other than `<textarea>` as a base. The root cause of the issue was a     mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data     pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that     depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed     features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are     no known workarounds for this issue. (CVE-2022-31175)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
262321	Linux Distros Unpatched Vulnerability : CVE-2022-31175	Nessus	Misc.	Local	medium
409827	SCA: security update for @ckeditor/ckeditor5-html-embed, @ckeditor/ckeditor5-html-support, @ckeditor/ckeditor5-markdown-gfm (GHSA-42wq-rch8-6f6j)	Tenable Cloud Security	SCA Checks	Local	medium
409827	SCA: security update for @ckeditor/ckeditor5-html-embed, @ckeditor/ckeditor5-html-support, @ckeditor/ckeditor5-markdown-gfm (GHSA-42wq-rch8-6f6j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
114424	CKEditor < 5.35.0.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
164316	FreeBSD : drupal9 -- multiple vulnerabilities (03bb8373-2026-11ed-9d70-080027240888)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2022-31175

medium

Tenable Plugins

medium

medium

medium

medium

medium