Every CVE Search/ Get API key

CVE-2025-25299

Cross-site scripting (XSS) in the real-time collaboration package

2.3 LowFix available

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.60%Up 0.6 points since Feb 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.3

Cross-site scripting (XSS) in the real-time collaboration package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2025-25299
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
EUVDEUVD-2025-4561 2.3

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2025-4561
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j3mm-wmfm-mwvh 6.9

Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package

Impact

During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.

This vulnerability affects only installations with Real-time collaborative editing enabled.

Patches

The problem has been recognized and patched. The fix will be available in version 44.2.1 (and above).

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Record
GHSA-j3mm-wmfm-mwvh
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
NVD 2.3

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2025-25299
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSV 2.3

Cross-site scripting (XSS) in the real-time collaboration package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2025-25299
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSVGHSA-j3mm-wmfm-mwvh 6.9

Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package

Impact

During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.

This vulnerability affects only installations with Real-time collaborative editing enabled.

Patches

The problem has been recognized and patched. The fix will be available in version 44.2.1 (and above).

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Record
GHSA-j3mm-wmfm-mwvh
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSVUBUNTU-CVE-2025-25299 2.3

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
UBUNTU-CVE-2025-25299
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@ckeditor/ckeditor5-real-time-collaboration
npm
 41.3.0 to 44.2.0
44.2.1
ckeditor5-premium-features
npm
 42.0.0 up to 44.2.0
44.2.0
@ckeditor/ckeditor5-real-time-collaboration
npm
 41.3.0 up to 44.2.1
44.2.1
ckeditor5-premium-features
npm
 42.0.0 up to 44.2.1
44.2.1
ckeditor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-24.5.7+dfsg-2ubuntu0.16.04.1~esm14.5.7+dfsg-2ubuntu0.16.04.1~esm24.5.7+dfsg-2ubuntu0.16.04.1~esm3
 None known
ldap-account-manager
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.9-15.1-15.2-15.2-1ubuntu1
 None known
request-tracker4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.2.11-24.2.12-34.2.12-44.2.12-5
 None known
ckeditor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5.7+dfsg-24.5.7+dfsg-2ubuntu0.18.04.14.5.7+dfsg-2ubuntu0.18.04.1+esm14.5.7+dfsg-2ubuntu0.18.04.1+esm2
 None known
ckeditor3
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-1
 None known
ldap-account-manager
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.7-16.1-16.2-1
 None known
Show 18 moreShow less
Affected packages
PackageAffectedFixed
request-tracker4
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.4.1-54.4.2-14.4.2-24.4.2-2ubuntu0.1~esm1
 None known
ckeditor
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.11.1+dfsg-14.12.1+dfsg-14.12.1+dfsg-1ubuntu0.14.12.1+dfsg-1ubuntu0.1+esm14.12.1+dfsg-1ubuntu0.1+esm2
 None known
ckeditor3
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-33.6.6.1+dfsg-4
 None known
ldap-account-manager
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.7-1
 None known
request-tracker4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.4.3-24.4.3-2+deb10u3build0.20.04.1
 None known
ckeditor3
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-7
 None known
ldap-account-manager
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.5-17.7-1
 None known
request-tracker4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu1.22.04.1
 None known
ckeditor
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.16.0+dfsg-24.16.2+dfsg-14.16.2+dfsg-1ubuntu0.1~esm14.16.2+dfsg-1ubuntu0.1~esm2
 None known
ckeditor3
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-7
 None known
ldap-account-manager
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.3-18.5-1
 None known
request-tracker4
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu24.4.7+dfsg-1
 None known
ckeditor
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
4.22.1+dfsg1-24.22.1+dfsg1-2ubuntu0.24.04.1~esm14.22.1+dfsg1-2ubuntu0.24.04.1~esm2
 None known
ckeditor
Ubuntu:25.10
 All versions, plus listed versions
4.22.1+dfsg1-2ubuntu14.22.1+dfsg1-2ubuntu1.1
 None known
ldap-account-manager
Ubuntu:25.10
 All versions, plus listed versions
9.0-1
 None known
request-tracker4
Ubuntu:25.10
 All versions, plus listed versions
4.4.7+dfsg-4syncable1
 None known
ldap-account-manager
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0-19.0-1build1
 None known
request-tracker4
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.7+dfsg-4syncable1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-25299 is a low vulnerability (CVSS 2.3) in Ckeditor Ckeditor5, published February 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in @ckeditor/ckeditor5-real-time-collaboration 44.2.1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open