# CVE-2024-45613: CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package


- **Severity:** Medium 5.1 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N`)
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 25 Sep 2024
- **Updated:** 1 Oct 2024
- **Also known as:** GHSA-rgg8-g5x8-wr9v, UBUNTU-CVE-2024-45613

## What is CVE-2024-45613?

CVE-2024-45613 is a medium-severity vulnerability in ckeditor5, published on 25 Sep 2024. 

### Official description

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.

Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)

## Which versions are affected by CVE-2024-45613?

4 open source packages ship an affected version, including @ckeditor/ckeditor5-clipboard and ckeditor5. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@ckeditor/ckeditor5-clipboard` | npm | From 40.0.0 | 43.1.1 |
| `@ckeditor/ckeditor5-clipboard` | npm | From 40.0.0 | 43.1.1 |
| `ckeditor5` | npm | From 40.0.0 | 43.1.1 |
| `ckeditor5` | npm | From 40.0.0 | 43.1.1 |

Products: Ckeditor Ckeditor5.

## How do I fix CVE-2024-45613?

Upgrade @ckeditor/ckeditor5-clipboard to 43.1.1 or later.

## Is CVE-2024-45613 being exploited?

There is no known exploitation of CVE-2024-45613 in the wild and no public exploit code.

## Other vulnerabilities in ckeditor5

- [CVE-2021-21254](https://insights.sbomify.com/CVE-2021-21254/): Regular expression Denial of Service in Markdown plugin (medium 6.5)
- [CVE-2026-28343](https://insights.sbomify.com/CVE-2026-28343/): CKEditor: Cross-site scripting (XSS) in the HTML Support package (medium 6.4)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-45613 and fix it if it is affected.

What it is: CVE-2024-45613 is a medium-severity vulnerability in ckeditor5, published on 25 Sep 2024. 
Exploitation: There is no known exploitation of CVE-2024-45613 in the wild and no public exploit code.

Affected packages and fixed versions:
- @ckeditor/ckeditor5-clipboard (npm): affected from 40.0.0; fixed in 43.1.1
- @ckeditor/ckeditor5-clipboard (npm): affected from 40.0.0; fixed in 43.1.1
- ckeditor5 (npm): affected from 40.0.0; fixed in 43.1.1
- ckeditor5 (npm): affected from 40.0.0; fixed in 43.1.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-45613/ (Markdown: https://insights.sbomify.com/CVE-2024-45613/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-45613
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-45613
- OSV: https://osv.dev/vulnerability/CVE-2024-45613

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-45613/
Summaries are generated and may contain mistakes; the official description above is the record.