CVE-2025-25299 Cross-site scripting (XSS) in the real-time collaboration package
An XSS vulnerability in CKEditor 5's real-time collaboration package allows unauthorized JavaScript execution when specific configurations are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-25299?
CVE-2025-25299 is a low-severity cross-site scripting vulnerability in ckeditor5, published on 20 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2025-25299?
4 open source packages ship an affected version, including @ckeditor/ckeditor5-real-time-collaboration and ckeditor5-premium-features.
| Package | Affected | Fixed in |
|---|---|---|
@ckeditor/ckeditor5-real-time-collaboration npm | From 41.3.0 | 44.2.1 |
@ckeditor/ckeditor5-real-time-collaboration npm | From 41.3.0 | 44.2.1 |
ckeditor5-premium-features npm | From 42.0.0 | 44.2.1 |
ckeditor5-premium-features npm | From 42.0.0 | 44.2.1 |
How do I fix CVE-2025-25299?
Upgrade @ckeditor/ckeditor5-real-time-collaboration to 44.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-25299 being exploited?
There is no known exploitation of CVE-2025-25299 in the wild and no public exploit code.
Sources
Also known as GHSA-j3mm-wmfm-mwvh, UBUNTU-CVE-2025-25299.