CVE-2025-25299 json
Cross-site scripting (XSS) in the real-time collaboration package
published 2025-02-20 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-4561 , GHSA-j3mm-wmfm-mwvh
- cvss
- 2.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- npm @ckeditor/ckeditor5-real-time-collaboration 44.2.1
- npm ckeditor5-premium-features 44.2.1
- ckeditor ckeditor5-markdown-gfm 44.2.1
- ckeditor ckeditor5-list 44.2.1
- ckeditor ckeditor5-image 44.2.1
- ckeditor ckeditor5-font 44.2.1
- ckeditor ckeditor5-engine 44.2.1
- ckeditor ckeditor5-paste-from-office 44.2.1
- ckeditor ckeditor5-widget 44.2.1
- ckeditor ckeditor5 44.2.1
- ckeditor ckeditor5-media-embed 44.2.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @ckeditor/ckeditor5-real-time-collaboration | >=41.3.0, <44.2.1 |
44.2.1 |
| npm | ckeditor5-premium-features | >=42.0.0, <44.2.1 |
44.2.1 |
Affected products
- ckeditor ckeditor5
Classification
References
-
github.com
/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh
web
-
ckeditor.com
/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html
web
-
github.com
/ckeditor/ckeditor5/releases/tag/v44.2.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-25299
advisory
-
ckeditor.com
/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dc
web
-
github.com
/ckeditor/ckeditor5
package
Sources
- CVE List CVE-2025-25299
- GitHub Advisory GHSA-j3mm-wmfm-mwvh
- NVD CVE-2025-25299
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.