Description
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.
Recommendation
Update the @ckeditor/ckeditor5-engine package to the latest compatible version. Followings are version details:
- Affected version(s): <= 26.0.0
- Patched version(s): 27.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-engine and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-list - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-image - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-font - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-media-embed - CVE-2021-21391
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023