{"id":"CVE-2018-11093","aliases":["EUVD-2018-0193","GHSA-gvpx-9459-w3mj"],"status":"published","title":"Cross-Site Scripting in @ckeditor/ckeditor5-link","description":"Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00997,"percentile":0.62983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-05-22T18:00:00Z","modified":"2026-10-20T10:49:46Z","fixes":[{"ecosystem":"npm","package":"@ckeditor/ckeditor5-link","fixed_in":["10.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@ckeditor/ckeditor5-link","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"10.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@ckeditor/ckeditor5-link","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"10.0.1"}]}]}],"products":[{"vendor":"ckeditor","product":"ckeditor_5-link"}],"references":[{"url":"https://github.com/ckeditor/ckeditor5-link/blob/master/CHANGELOG.md#1001-2018-05-22","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://ckeditor.com/blog/CKEditor-5-v10.0.1-released/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11093","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gvpx-9459-w3mj","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-CKEDITORCKEDITOR5LINK-72892","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1154","tags":["web"]},{"url":"https://github.com/ckeditor/ckeditor5-link/commit/8cb782eceba10fc481e4021cb5d25b2a85d1b04e","tags":["web"]},{"url":"https://ckeditor.com/blog/CKEditor-5-v10.0.1-released","tags":["web"]},{"url":"https://github.com/ckeditor/ckeditor5-link","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-11093","description":"Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.","status":"published","published":"2018-05-22T18:00:00Z","modified":"2024-08-05T07:54:36.54Z","updated_at":"2026-11-02T14:35:09.908186Z"}],"euvd":[{"id":"EUVD-2018-0193","description":"Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.","status":"published","published":"2018-05-22T18:00:00Z","modified":"2024-08-05T07:54:36Z","updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-gvpx-9459-w3mj","title":"Cross-Site Scripting in @ckeditor/ckeditor5-link","description":"Versions of `status-board` prior to 10.0.1 are vulnerable to Cross-Site Scripting. The `_createPreviewButton()` function fails to sanitize the `href` attribute of a created `\u003ca\u003e` tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 10.0.1 or later.","status":"published","published":"2018-05-23T20:37:46Z","modified":"2023-05-01T21:01:03Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2018-11093","description":"Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.","status":"published","published":"2018-05-22T18:29:00.233Z","modified":"2026-06-17T01:35:15.527Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11093","description":"Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.","status":"published","published":"2018-05-22T18:29:00.233Z","modified":"2026-10-20T10:49:46.454199174Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"GHSA-gvpx-9459-w3mj","title":"Cross-Site Scripting in @ckeditor/ckeditor5-link","description":"Versions of `status-board` prior to 10.0.1 are vulnerable to Cross-Site Scripting. The `_createPreviewButton()` function fails to sanitize the `href` attribute of a created `\u003ca\u003e` tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 10.0.1 or later.","status":"published","published":"2018-05-23T20:37:46Z","modified":"2023-11-08T03:59:45.405001Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}