CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.

According to its self-reported version number, the CKEditor application running on the remote host is prior to 5.35.0.1. It is, therefore, affected by a Cross-Site-Scripting after fulfilling special conditions.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 03bb8373-2026-11ed-9d70-080027240888 advisory.

  - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered     affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to     trigger a JavaScript code after fulfilling special conditions. The affected packages are     `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-     embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-     support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows     unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an     element and using an element other than `<textarea>` as a base. The root cause of the issue was a     mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data     pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that     depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed     features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are     no known workarounds for this issue. (CVE-2022-31175)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114424	CKEditor < 5.35.0.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
164316	FreeBSD : drupal9 -- multiple vulnerabilities (03bb8373-2026-11ed-9d70-080027240888)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-31175

medium

Tenable Plugins

medium

medium