CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered by a specific user action (leading to unauthorized JavaScript code execution) if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects installations where the editor configuration meets one of the following criteria: the HTML embed plugin is enabled, or there is a custom plugin introducing an editable element where view RawElement is enabled. This issue is fixed in versions 45.2.2 and 46.0.3 of both ckeditor5 and ckeditor5-clipboard.

According to its self-reported version number, the CKEditor application running on the remote host is 5.44.2.x prior to 5.45.2.2 or 5.46.0.2 prior to 5.46.0.3. It is, therefore, affected by a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and
    ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site
    Scripting (XSS) vulnerability. Ability to exploit could be triggered by a specific user action (leading to
    unauthorized JavaScript code execution) if the attacker managed to insert a malicious content into the
    editor, which might happen with a very specific editor configuration. This vulnerability affects
    installations where the editor configuration meets one of the following criteria: the HTML embed plugin is
    enabled, or there is a custom plugin introducing an editable element where view RawElement is enabled.
    This issue is fixed in versions 45.2.2 and 46.0.3 of both ckeditor5 and ckeditor5-clipboard.
    (CVE-2025-58064)

ID	Name	Product	Family	Severity
115161	CKEditor 5.46.0.2 < 5.46.0.3 Cross-Site Scripting	Web App Scanning	Component Vulnerability	low
115160	CKEditor 5.44.2.x < 5.45.2.2 Cross-Site Scripting	Web App Scanning	Component Vulnerability	low
435182	SCA: security update for @ckeditor/ckeditor5-clipboard, ckeditor5 (GHSA-x9gp-vjh6-3wv6)	Tenable Cloud Security	SCA Checks	low
435182	SCA: security update for @ckeditor/ckeditor5-clipboard, ckeditor5 (GHSA-x9gp-vjh6-3wv6)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2025-58064

low

Tenable Plugins

low

low

low

low