Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

Description

The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.

Recommendation

Update the ckeditor-dev package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.5.10, < 4.9.2
• Patched version(s): 4.9.2

References

• GHSA-g78h-pf65-46rv
• www.drupal.org
• www.oracle.com
• www.securityfocus.com
• CVE-2018-9861
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor - CVE-2023-37905
• Bootstrap vulnerable to Cross-Site Scripting (XSS) - CVE-2018-14040
• Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
• CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support - CVE-2026-28343

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

ckeditor-dev