Description
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze.
Recommendation
Update the @ckeditor/ckeditor5-markdown-gfm package to the latest compatible version. Followings are version details:
- Affected version(s): <= 24.0.0
- Patched version(s): 25.0.0
References
Could your website be exposed too?
SmartScanner can check your website for CKEditor 5 Markdown plugin Regular expression Denial of Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-media-embed - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-list - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-paste-from-office - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget - CVE-2021-21391
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023