TI-2025-18953 Aliases CVE-2025-25299 GHSA-j3mm-wmfm-mwvh

Cross-site scripting (XSS) in the real-time collaboration package

LOW 19CWE-79Published 2025-02-20 · Updated 2025-02-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00603 49th percentileScored 2026-11-07

Fix Fixed @ckeditor/ckeditor5-real-time-collaboration (npm): 44.2.1ckeditor5-premium-features (npm): 44.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ckeditor	ckeditor5	@ckeditor/ckeditor5-real-time-collaboration: >= 41.3.0, < 44.2.1; ckeditor5-premium-features: >= 42.0.0, < 44.2.1	—	No fix listed	CNA
—	@ckeditor/ckeditor5-real-time-collaboration (npm)	41.3.0 to before 44.2.1	44.2.1	Patch available	GHSA-j3mm-wmfm-mwvh
—	ckeditor5-premium-features (npm)	42.0.0 to before 44.2.1	44.2.1	Patch available	GHSA-j3mm-wmfm-mwvh

ckeditor5 Vendorckeditor Affected @ckeditor/ckeditor5-real-time-collaboration: >= 41.3.0, < 44.2.1; ckeditor5-premium-features: >= 42.0.0, < 44.2.1 Fixed in — No fix listed CNA
@ckeditor/ckeditor5-real-time-collaboration (npm) Vendor— Affected 41.3.0 to before 44.2.1 Fixed in 44.2.1 Patch available GHSA-j3mm-wmfm-mwvh
ckeditor5-premium-features (npm) Vendor— Affected 42.0.0 to before 44.2.1 Fixed in 44.2.1 Patch available GHSA-j3mm-wmfm-mwvh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:ckeditor:ckeditor5::::::::	—	—	ckeditor

cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:* Versions — — ·ckeditor

Remediation

Fix · GHSA-j3mm-wmfm-mwvh @ckeditor/ckeditor5-real-time-collaboration (npm) Fixed in 44.2.1 Advisory →
Fix · GHSA-j3mm-wmfm-mwvh ckeditor5-premium-features (npm) Fixed in 44.2.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-25299
2026-10-03 Alias added: GHSA-j3mm-wmfm-mwvh

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-25299

Other 5

TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
TI-2026-81521 Cross-site scripting in CKEditor 5 engine package CVSS 3.1HIGH 8.1
TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences