GHSA-q9w4-w667-qqj4: ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-q9w4-w667-qqj4

ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor

Package

npm ckeditor-wordcount-plugin (npm)

Affected versions

<= 1.17.10

Description

Problem

It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.

Solution

Update to version 1.17.11 of the ckeditor-wordcount-plugin plugin.

Credits

• @sypets for reporting this finding to the TYPO3 Security Team
• @ohader for fixing the issue on behalf of the TYPO3 Security Team

References

• GHSA-q9w4-w667-qqj4
• w8tcha/CKEditor-WordCount-Plugin@0f03b3e

Published to the GitHub Advisory Database

Jul 10, 2023

Last updated

Jul 10, 2023