Detections
Analytics

SCA: security update for @ckeditor/ckeditor5-html-embed, @ckeditor/ckeditor5-html-support, @ckeditor/ckeditor5-markdown-gfm (GHSA-42wq-rch8-6f6j)

medium Tenable Self-Hosted Container Security Plugin ID 409827

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered
 affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to
 trigger a JavaScript code after fulfilling special conditions. The affected packages are
 `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-
 embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-
 support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows
 unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an
 element and using an element other than `<textarea>` as a base. The root cause of the issue was a
 mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data
 pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that
 depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed
 features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are
 no known workarounds for this issue. (CVE-2022-31175)

See Also

https://github.com/advisories/GHSA-42wq-rch8-6f6j

Plugin Details

Severity: Medium

ID: 409827

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2022-31175

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/6/2022

Vulnerability Publication Date: 8/3/2022

Reference Information

CVE: CVE-2022-31175

cwe: CWE-79