{"answers":{"affected":"4 open source packages ship an affected version, including @ckeditor/ckeditor5-clipboard and ckeditor5. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-45613 in the wild and no public exploit code.","fix":"Upgrade @ckeditor/ckeditor5-clipboard to 43.1.1 or later.","what":"CVE-2024-45613 is a medium-severity vulnerability in ckeditor5, published on 25 Sep 2024."},"fix_prompt":"Check this codebase for CVE-2024-45613 and fix it if it is affected.\n\nWhat it is: CVE-2024-45613 is a medium-severity vulnerability in ckeditor5, published on 25 Sep 2024. \nExploitation: There is no known exploitation of CVE-2024-45613 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @ckeditor/ckeditor5-clipboard (npm): affected from 40.0.0; fixed in 43.1.1\n- @ckeditor/ckeditor5-clipboard (npm): affected from 40.0.0; fixed in 43.1.1\n- ckeditor5 (npm): affected from 40.0.0; fixed in 43.1.1\n- ckeditor5 (npm): affected from 40.0.0; fixed in 43.1.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-45613/ (Markdown: https://insights.sbomify.com/CVE-2024-45613/index.md)","id":"CVE-2024-45613","markdown":"https://insights.sbomify.com/CVE-2024-45613/index.md","name":"CVE-2024-45613","record":{"aliases":["GHSA-rgg8-g5x8-wr9v","UBUNTU-CVE-2024-45613"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[{"product":"ckeditor5","vendor":"ckeditor"}],"cvss":{"score":5.1,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package","id":"CVE-2024-45613","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2024"},"n_packages":4,"n_references":2,"next":{"headline":"Header normalization allows for client to clobber proxy set headers in Puma","id":"CVE-2024-45614"},"packages":[{"ecosystem":"npm","fixed":["43.1.1"],"introduced":["40.0.0"],"last_affected":[],"package":"@ckeditor/ckeditor5-clipboard","purl":null,"source":"GHSA-rgg8-g5x8-wr9v"},{"ecosystem":"npm","fixed":["43.1.1"],"introduced":["40.0.0"],"last_affected":[],"package":"@ckeditor/ckeditor5-clipboard","purl":"pkg:npm/%40ckeditor/ckeditor5-clipboard","source":"GHSA-rgg8-g5x8-wr9v"},{"ecosystem":"npm","fixed":["43.1.1"],"introduced":["40.0.0"],"last_affected":[],"package":"ckeditor5","purl":null,"source":"GHSA-rgg8-g5x8-wr9v"},{"ecosystem":"npm","fixed":["43.1.1"],"introduced":["40.0.0"],"last_affected":[],"package":"ckeditor5","purl":"pkg:npm/ckeditor5","source":"GHSA-rgg8-g5x8-wr9v"}],"prev":{"headline":"Insert tag injection via canonical URL in Contao","id":"CVE-2024-45612"},"products":["ckeditor5"],"published":"2024-09-25","related":[{"cvss_score":6.5,"headline":"Regular expression Denial of Service in Markdown plugin","id":"CVE-2021-21254","kev_date_added":null,"published":"2021-01-29"},{"cvss_score":6.4,"headline":"CKEditor: Cross-site scripting (XSS) in the HTML Support package","id":"CVE-2026-28343","kev_date_added":null,"published":"2026-03-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-01","vendors":["ckeditor"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2024-45613/"}