Skip to content

Releases: ckeditor/ckeditor5

v44.3.0

05 Mar 08:02
@CKEditorBot CKEditorBot
v44.3.0
93a9313
This commit was signed with the committer’s verified signature.
CKEditorBot CKEditor Bot
GPG key ID: 3F615B600F38B27B
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v44.3.0 Latest
Latest

We are happy to announce the release of CKEditor 5 v44.3.0.

Release Highlights

This release brings a couple of minor improvements and bug fixes:

  • Link Decorators: We fixed the behavior of the multiple manual link decorators that set the rel attribute. The fix happened so deep in the engine that we improved the overall performance of the editor slightly as well.
  • Added a new EmptyBlock plugin: From now on, new plugin prevents adding   to the output data of blocks, works similarly to the fillEmptyBlocks configuration in CKEditor 4.
  • Support for the <hr> element in the General HTML Support plugin enhanced: attributes of the <hr> element are now properly preserved if configuration allows it.
  • Emoji: We enhanced emoji support for better compatibility with users' older devices.

For more details, see the changelog below.

MINOR BREAKING CHANGES ℹ️

  • engine: The ViewConsumable.consumablesFromElement() is removed and replaced with the view.Element#_getConsumables() internal method. You should use ViewConsumable.createFrom() to create consumables if needed.
  • engine: The ViewElementConsumables now accepts and outputs only normalized data. The ViewConsumable still accepts normalized or non-normalized input.
  • engine: The Matcher#match() and Matcher#matchAll() output is now normalized. The MatchResult#match now contains normalized data compatible with changes in the ViewConsumable.

Features

Bug fixes

  • collaboration-core: User initials will now be generated based on the words that start with letters, ensuring that only valid alphabetic characters are used in the initials.
  • comments: Annotations will no longer be lost during real-time collaboration when a user removes and immediately reverts (undo) content containing comment markers.
  • comments: The editor will no longer crash when one user removes content containing a comment that another user is editing.
  • engine: The link [rel] attribute will now allow mixing manual link decorators for the same attribute, as it will be now handled as a token list. Closes #13985, Closes #6436. (commit)
  • mention: Mention should not be wrapped with an additional <span> when GHS is enabled. Closes #15329. (commit)
  • ui: Fixed an issue where the first selected color was applied instead of the second selected color when using the font color picker for the first time after loading the page. Closes #17069. (commit)
  • typing: Removing a nested editable does not remove an entire widget when the selection is placed at the beginning of that element. (commit)

Other changes

  • clipboard: Export the viewToPlainText() function. Closes #17950. (commit)
  • collaboration-core: Introduced a new configuration option: config.users.getInitialsCallback. It allows providing a custom callback function for user initials generation.
  • emoji: Improved emoji support by expanding the range of versions compatible with users' devices. Closes #18014. (commit)
  • emoji: Icons representing categories in the grid come from the same Unicode version to avoid rendering the non-supported ones. (commit)
  • emoji: Introduced the emoji.useCustomFont option to disable the filtering mechanism. Closes #18029. (commit)
  • engine: The whitespaces around a block filler (&nbsp;) are ignored while loading editor data. (commit)

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Minor releases (contain minor breaking changes):

Releases containing new features:

Other releases:

Read more
Assets 2
Loading

v44.2.1

20 Feb 09:29
@CKEditorBot CKEditorBot
v44.2.1
4e45feb
This commit was signed with the committer’s verified signature.
CKEditorBot CKEditor Bot
GPG key ID: 3F615B600F38B27B
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v44.2.1

We are happy to announce the release of CKEditor 5 v44.2.1.

During a recent internal audit, we identified a cross-site scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package (CVE-2025-25299). This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.

This vulnerability affects only installations with real-time collaborative editing enabled.

You can read more details in the relevant security advisory and contact us if you have more questions.

Bug fixes

  • comments: Fixed a few scenarios for which creating a new comment thread was impossible (for example, when a selection was made on multiple table cells). This was a regression introduced in v44.2.0.

Other changes

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Other releases:

Read more
Loading

v44.2.0

12 Feb 08:38
@CKEditorBot CKEditorBot
v44.2.0
6b7f659
Compare
Choose a tag to compare
v44.2.0

We are happy to announce the release of CKEditor 5 v44.2.0.

Release Highlights

🖥️ Enhanced Source Code Editing (⭐)

Introducing new premium feature: Enhanced Source Code Editing. It displays the source code in a dialog and is compatible with all editor types. It offers syntax highlighting, code completion, code folding, and other advanced functionalities. Additionally, it supports both HTML and Markdown formats.

📤 Uploadcare and image optimizer (⭐)

We have integrated the Uploadcare image manager service, enabling you to upload and edit images to their cloud environment. You can upload files from various sources, including local devices, social media, or online drives ensuring rapid uploads. The integration takes care of efficient media delivery with responsive images mechanism, making sure your users will save bandwidth and have faster website loading. You can also optimize images with the built-in image editor which offers a range of features, such as cropping, rotating, flipping, photo filters and more. All this directly from the editor, try it out!

🖼️ Image Merge Fields (⭐)

Image merge fields are a new type of merge fields, dedicated for image placeholders. They maintain all standard image interactions, like styling, resizing or captions (in which you can use merge fields too!) At the same time, they keep all merge fields functionalities, like data previews or document export integration. In the document data, image merge fields are represented like other images, however their src attribute is set to a respective merge field, for example, src="{{CompanyLogo}}", making them easy to post-process!

📝 Track Changes Preview (⭐)

We have added the preview mode that displays a document with all suggestions accepted. Accessible from the track changes dropdown, this modal preview helps check the final content without extensive markers.

😀 Emoji support

They are here! 🎉 🥳 🎊 Insert emojis effortlessly in the editor by typing : or through a user-friendly emoji picker. This feature enhances the richness of your content by allowing quick access to a wide range of emojis.

⚡ Performance improvements: Part 4

Here comes the final batch of the planned performance improvements in the editor loading speed area, that we worked on through a couple of past releases.

  • A new caching mechanism in Mapper now handles model-to-view mappings, substantially improving performance for loading and saving data.
  • Images with specified height and width automatically use [loading="lazy"] in the editing area, optimizing the loading time (read more on MDN). This attribute is only applied during editing to enhance the loading efficiency of images, and it does not reflect in the final data output.

We are greatly satisfied with the improved editor loading times. At the same time, we acknowledge some other problematic areas, and we will keep delivering more performance-related improvements in the future.

MINOR BREAKING CHANGES ℹ️

  • engine: Mapper#registerViewToModelLength() is now deprecated and will be removed in one of the upcoming releases. This method is useful only in obscure and complex converters, where model element, or a group of model elements, are represented very differently in the view. We believe that every feature using a custom view-to-model length callback can be rewritten in a way that this mechanism is no longer necessary. Note: if this method is used, the caching mechanism for Mapper will be turned off which may degrade performance when handling big documents. Note: this method is used by the deprecated legacy lists feature. As a result, you will not experience the performance improvements if you are still using the deprecated legacy lists feature.
  • image: Starting this release, images that have [height] and [width] attributes set will automatically receive the [loading="lazy"] attribute in the editing area. This happens only for the content loaded into the editor, the data output produced by the editor remains the same. The reason for this change is to improve user experience in documents that may contain hundreds of images.
  • list: The lower-alpha and upper-alpha list styles are now upcasted to lower-latin and upper-latin styles.
  • merge-fields: The MergeFieldsEditing#getLabel() method will now return null instead of the merge field id if the merge field definition was not found or it did not contain the label property.
  • basic-styles: Elements which contains the [style] attribute with word-wrap: break-word will not be converted to <code>. See #17789.

Features

  • ai: Comment threads will now be preserved when AI Assistant processes selected content with comments. This can be disabled through the ai.aiAssistant.preserveComments flag. Note, that the actual result depends on the response provided by the AI model (AI model has to keep the comments markup in the response). Additionally, the copy-paste comments functionality must be enabled (configured by comments.copyMarkers).
  • ai: The ai.aiAssistant.removeCommands configuration now allows removing entire command groups.
  • ckbox: It is now allowed to specify which files chosen from CKBox are downloadable. Closes #15928. (commit)
  • clipboard: Added the ability to detect paste events originating from the editor. Closes #15935. (commit)
  • clipboard: Passed information to the downcast converter when clipboard pipeline is used to allow for customization. Closes #17745. (commit)
  • clipboard: The viewToPlainText() helper will now parse the view RawElement instances. Closes #17746. (commit)
  • emoji: Created the Emoji feature. Closes #17361. (commit)
  • image: Added a possibility to break the current block by InsertImageCommand with the breakBlock flag. Closes #17742. (commit)
  • list: Allowed to specify which list style types are shown in list type selector dropdown. Closes #17176. (commit)
  • list: Added support for the lower-alpha and upper-alpha list type highlighting in the list style properties buttons. Closes #17424. (commit)
  • mention: Allowed the mention marker to be longer than 1 character. Closes #17744. (commit)
  • merge-fields: Introduced the image merge fields.
  • merge-fields: Added the [data-merge-field-name] attribute...
Read more
Loading

v44.1.0

16 Dec 08:25
@CKEditorBot CKEditorBot
v44.1.0
9143089
Compare
Choose a tag to compare
v44.1.0

We are pleased to announce the latest CKEditor 5 release, focusing on performance enhancements and key bug fixes to improve your editing and collaboration experience.

Release Highlights

⚡ Performance enhancements: Part 3

This release introduces another set of performance related improvements, focused on faster editor initialization for huge documents. The initialization time was lowered by further 15% to 45%, depending on the tested sample.

The combined improvements introduced in recent releases amount to around 65%-80% lower loading time in total, which means the editor will load 3-5x faster. As the gain is not linear, bigger documents see even better improvement (more than 10x faster).

Moreover, all these improvements positively impact document save time (editor.getData()), which should help with autosave issues, among others.

We still actively work in this area, so you may expect even more editor load and save efficiency improvements in the upcoming releases.

🔨 Bug Fixes and improvements

  • Comments enhancements:
    • Data export options: We introduced the showCommentHighlights option in editor.getData(), that changes the comment marker conversion, allowing for styling comments in the output. Perfect for showing what was commented in Export to PDF, for example.
    • Inline mode improvements: We addressed a problem where comment annotations in inline mode did not close properly when clicking elsewhere in the content.
    • Thread management: We resolved an issue where creating a new thread was not interrupted when the corresponding marker was removed from the content, ensuring better stability during collaborative editing.
  • Revision History update:
    • Restore functionality: We disabled the ability to restore the current (edited, not saved) revision, as it represents current content, so there is nothing to restore. At the same time, using it led to some non-obvious behaviors.
  • Image handling: We resolved an issue where images in the uploading state could be deleted when dragged and dropped within the editor. Keep dragging, even when it is not there 🙈.

🎄 Happy holidays!

As the holiday season approaches, we extend our warmest wishes to our community and users. Thank you for your continued support, and we look forward to bringing you further enhancements and exciting features in the coming year.

MINOR BREAKING CHANGES ℹ️

  • utils: spliceArray now modifies the target array and does not accept a fourth (count) argument.

Features

  • comments: Introduced the showCommentHighlights option in editor.getData() method that changes the comment marker conversion and allows styling the comments in the output.

Bug fixes

  • comments: Resolved an issue where creating a new thread was not interrupted when the corresponding marker was removed from the content, for example, by another user in real-time collaboration.
  • comments: When adding a comment in inline mode, the comment annotation will now close properly if you click elsewhere in the content.
  • find-and-replace: It should be possible to search within content of inline widgets. Closes #11162. (commit)
  • image: Copying and pasting images in the uploading state is now possible. Closes #16967. (commit)
  • ui: Surrounding spaces are no longer added to colors produced by hex inputs. Closes #17386. (commit)

Other changes

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Minor releases (contain minor breaking changes):

Other releases:

Read more
Loading

v44.0.0

02 Dec 08:14
@CKEditorBot CKEditorBot
v44.0.0
c8152a2
Compare
Choose a tag to compare
v44.0.0

Release Highlights

We are excited to introduce CKEditor 5 v44.0.0, a release packed with high impact updates designed to enhance your editing experience and simplify access to our premium offers. Here's what’s new:

🚀 Self-service plans: Simplified access to premium features

We are introducing flexible self-service plans that put you in control with full transparency. Now, you can:

💡 Important for current users:

If you are upgrading to v44.0.0+, ensure a smooth transition by updating your license keys in the editor, as we implemented a new format of the key. To get the new key, visit the Customer Portal. You can also refer to our license key and activation guide for help with logging in to the portal.

📣 The open-source licensing remains unchanged. However, config.licenseKey is now a required property in the editor configuration. Use 'GPL' for installations under the GPL terms. Read more in the update guide.

🔖 Bookmarks: Organize your content with ease

Say hello to Bookmarks, a long-awaited feature that simplifies content navigation within the editor. With this release, you can:

  • Add anchors as reference points within text.
  • Link to the newly created bookmarks in the editor to navigate to specific locations within complex documents, such as contracts or technical manuals.

📍 Future updates to Bookmarks and the linking experience are planned for the upcoming releases. Follow progress and share your feedback on GitHub.

⚡ Performance improvements: Faster table rendering

The current release includes another stride towards improving the performance aspect of the editor, this time focusing on how tables are handled in the content. Implemented optimizations have made table rendering 3x faster, with the average load time of a document with a very long, complex tables dropping from around 4.5 seconds to just 1.5 seconds.

MAJOR BREAKING CHANGES ℹ️

  • config.licenseKey is now a required property in the editor configuration. Use 'GPL' for installations under the GPL terms. See #17317.

Features

Bug fixes

  • clipboard: An in-text drop of an inline object with elements inside should be possible. Closes #16101. (commit)
  • cloud-services: Handle refresh token when editor destroyed during token fetching. Closes #17462. (commit)
  • editor-classic: Excluded modal windows from the Classic Editor's integration between dialogs and the sticky toolbar. Closes #17339. (commit)
  • engine: List markers should be visible after changing the list type from multi-level to numbered. Closes #17488. (commit)
  • find-and-replace: Find and replace no longer randomly jumps to the first found item after the replace operation. Closes #16648. (commit)
  • list: Inserting or dropping a paragraph after the end of a list should not convert the paragraph to a list item. Closes #17224. (commit)
  • pagination: The pagination line should be rendered properly on tables. Closes ckeditor/ckeditor5#17158.
  • restricted-editing: Remove existing restricted editing markers when setting new data to prevent marker resurrection. Closes #9646, #16721. (commit)
  • theme-lark: Letter descenders should not be clipped in the top-level menu bar categories. Closes #17422. (commit)
  • track-changes: Export the AttributeData, FormatData and Description typings from package.
  • ui: The menu or dropdown panels will no longer be placed in an incorrect position when a optimal position cannot be found. Closes #17220. (commit)
  • ui: The dialog plugin should not handle Esc key press when default-prevented by the guest view. Closes #17343. (commit)
  • upload: Editor should no longer crash when executing undo while an image is still being uploaded. (commit)
  • utils: Use binary search in insertToPriorityArray() for better performance when handling big tables. (commit)
  • utils: No longer scroll to the top of the document if pasted element is larger than scrollable editable. Closes #17079. (commit)

Other changes

  • collaboration-core: The types of publicly exported plugins will now be correctly resolved when accessed using editor.plugins.get.

  • comments: The types of publicly exported plugins will now be correctly resolved when accessed using editor.plugins.get.

  • real-time-collaboration: Editor will be switched to read-only mode when an unrecoverable error will be returned by Cloud Services server during real-time editing.

  • real-time-collaboration: The types of publicly exported plugins will now be correctly resolved when accessed using editor.plugins.get.

  • revision-history: The types of publicly exported plugins will now be correctly resolved when accessed using editor.plugins.get.

  • track-changes: The types of publicly exported plugins will now be correctly resolved when accessed using editor.plugins.get.

  • track-changes: The descriptionFactory property will now be accessible publicly.

  • track-changes: Suggestions of the same type that are not directly next to each other will no longer be represented as one suggestion in the UI.

  • ui: Improved the performance of the BodyCollection DOM wrapper lookup by replacing document.querySelector() with a static element reference. (commit)

    Hu...

Read more
Loading

v43.3.1

06 Nov 08:40
@CKEditorBot CKEditorBot
v43.3.1
cdf33bb
Compare
Choose a tag to compare
v43.3.1

We are happy to announce the release of CKEditor 5 v43.3.1.

Release highlights

We had to revert a change introduced in v43.3.0 related to the icons export in one of our packages. This was due to unforeseen TypeScript issues in some setups.

Bug fixes

  • link: Reverted a change related to adding icons re-export. See #17358. (commit)

Other changes

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Other releases:

Read more
Loading

v43.3.0

29 Oct 09:23
@CKEditorBot CKEditorBot
v43.3.0
cce9594
Compare
Choose a tag to compare
v43.3.0

We are happy to announce the release of CKEditor 5 v43.3.0.

Release highlights

Performance improvements

We have improved how the editor handles the document structure by making it more reliable and efficient to access specific elements and verify their positions.

  • Node index and offset caching: The Node and NodeList elements now cache index and offset values, reducing the need for recalculations and significantly boosting overall performance during model operations.
  • Selection range validation: The newly implemented Position#isValid() method is also utilized to better validate selection ranges, ensuring more consistent behavior in various editing scenarios.
  • Performance improvements in numbers: The editor now loads content between 3x and, in some cases, up to 6x faster, depending on the type and size of the content. For instance, where a specific 200-page document previously took almost 25 seconds to load, the time has now been reduced to just 3.5 seconds.

We’re committed to ongoing performance enhancements, so you can expect even faster, smoother experience in future updates.

Export to Word watermark support

A new configuration option has been added to include a watermark when exporting documents to Word, providing additional flexibility in document branding and protection.

Notable bug fixes and improvements

  • Suggestions retention on revision restore: Suggestions are no longer lost in specific cases when restoring revisions with changes from multiple users. The revision tracking process has been improved to ensure that all operations, including markers, are handled and saved correctly during synchronization. This fix resolves issues where markers were previously not retained, ensuring consistent data handling in collaborative editing scenarios.
  • Action dropdown visibility fix: Resolved an issue where the action dropdown remained hidden after permission changes on comments. The dropdown now properly reflects updated permissions, allowing users to interact with the available actions seamlessly.
  • AI command enhancements:
    • Custom AI Commands are now correctly applied to individual dropdowns when only one group of comments is present, instead of the entire group.
    • Empty comment groups no longer render, improving UI clarity.
    • Fixed an issue where nested AI command menus would close unexpectedly when used within a balloon toolbar, preventing unintended behavior during selection.

Features

  • engine: Introduced the getChildAtOffset() method for model.Element and model.DocumentFragment. (commit)
  • engine: Introduced the Position#isValid() method to check whether the position exists in the current model tree. (commit)
  • export-word: Added a configuration setting for adding a watermark to generated documents.
  • revision-history: Introduced the RevisionTracker#getRevisionDocumentData() and RevisionTracker#getRevisionRootsAttributes() methods to the public scope of the editor API. You can use them to retrieve document data saved with the revision.
  • utils: Made FocusTracker extendable with other FocusTracker instances to allow logical focus tracking across separate DOM sub-trees (see #17277). (commit)

Bug fixes

  • ai: Empty AI Assistant command groups should not render in the UI.
  • ai: The AI Assistant command list should be flat when only one command group is available.
  • comments: Fixed an issue where the action dropdown remained hidden when permissions allowing actions on a comment changed.
  • engine: The content of an inline object should be handled as a flow root so whitespaces should be trimmed as the content of an inline object element is inside a block element. Closes #17199. (commit)
  • image: Handle existing picture element correctly on sources downcast. (commit)
  • link: No longer crash editor after removing link from image when LinkConfig#addTargetToExternalLinks: true is set. Closes #17252. (commit)
  • list-multi-level: Multi-level lists should display correctly in RTL mode for Decoupled Editor.
  • pagination: Improved pagination of large tables that are followed by block elements.
  • revision-history: Suggestions are no longer lost in some scenarios when restoring revisions in real-time collaboration.
  • ui: The dropdown menu component should not cause editor blur if used in a BalloonToolbar while the user hovers a nested menu. Closes #17277. (commit)
  • ui: Made the page unscrollable while the modal is visible. Closes #17093. (commit)

Other changes

  • engine: Node index and offset related values are now cached in model Node and NodeList to improve performance. (commit)
  • link: Exported link and unlink icons from the ckeditor5-link package. Closes #17304. (commit)
  • ui: Disabled dragging support for modal windows in the Dialog plugin. Closes #17290. (commit)
  • ui: Disabled positioning restrictions for modal windows caused by config.ui.viewportOffset. Closes #17290. (commit)

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Releases containing new features:

Other releases:

Read more
Loading

v41.3.2

15 Oct 07:53
@pomek pomek
v41.3.2
e8bb681
This commit was signed with the committer’s verified signature.
pomek Kamil Piechaczek
GPG key ID: 1858B58ACA4AE9CA
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v41.3.2

We are happy to announce the release of CKEditor 5 v41.3.2.

This release includes a security fix backported from version 43.1.1. Please take a look at the 43.1.1 release changelog to learn more about the changes.

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Other releases:

Read more
Loading

v43.2.0

02 Oct 08:29
@CKEditorBot CKEditorBot
v43.2.0
46c386c
Compare
Choose a tag to compare
v43.2.0

We are happy to announce the release of CKEditor 5 v43.2.0.

Release highlights

Notable improvements

  • Operational Transformation Stability: Significant changes have been made to the OT system, enhancing the undo functionality and real-time collaboration, especially in conflict resolution scenarios. These improvements ensure smoother editor operations during complex interactions.
  • Performance Improvements: We have merged several community-driven performance enhancements (thanks @sunesimonsen), that optimize the editor’s core engine. While no changes to the editor’s logic were made, these updates improve overall efficiency and responsiveness.

More imports available via ckeditor5 and ckeditor5-premium-features indexes

As users transition to new installation methods (v42.0.0+) with ckeditor5 and ckeditor5-premium-features as the main packages, we are continuously addressing missing imports for less common classes, functions, types, and utilities, broadening their availability. Since our TypeScript rewrite (v37.0.0), imports can now be made directly through the package indexes, simplifying integration. As many users historically imported from src, we encourage you to try the new version and report any missing imports. In the future, we are considering removing src from published packages to reduce package size, so the more feedback we receive, the better and more stable API we will provide.

Features

  • engine: Added the usePassive option to DomEventObserver that enables listening to passive events. Closes #16412. (commit)
  • media-embed: It is now possible to embed YouTube shorts. Closes #17090. (commit)
  • ui: Updated the "Powered by" link. (commit)

Bug fixes

  • ckbox: Editing inline images using CKBox no longer changes and reinserts them simultaneously. Closes #17056. (commit)
  • engine: Fixed incorrect marker handling in some scenarios involving undo and real-time collaboration, which earlier led to a model-nodelist-offset-out-of-bounds error. See #9296. (commit)
  • engine: Fixed incorrect handling of merge changes during undo in some scenarios involving real-time collaboration, which earlier led to a model-nodelist-offset-out-of-bounds error. See #9296. (commit)
  • engine: Fixed conflict resolution error, which led to editor crash in some scenarios where two users removed larger intersecting part of the content and used undo. See #9296. (commit)
  • engine: Fixed incorrect undo behavior leading to an editor crash when a user pressed Enter key multiple times, then pressed backspace that many times, then undid all the changes. Closes #9296. (commit)
  • theme-lark: Increased the specificity of the dropdown menu panel styles to address issues with incorrect z-index ordering. (commit)
  • ui: Fixed scrolling in dropdowns when a block toolbar button is active. Closes #17067. (commit)
  • ui: Increased the specificity of the dropdown menu panel styles to address issues with incorrect z-index ordering. (commit)

Other changes

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Releases containing new features:

Other releases:

Read more

Contributors

sunesimonsen
Loading

v43.1.1

25 Sep 07:43
@CKEditorBot CKEditorBot
v43.1.1
6b1e550
Compare
Choose a tag to compare
v43.1.1

We are happy to announce the release of CKEditor 5 v43.1.1.

During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (CVE-2024-45613). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.

This vulnerability affects only installations where the editor configuration meets the following criteria:

  1. The Block Toolbar plugin is enabled.
  2. One of the following plugins is also enabled:

You can read more details in the relevant security advisory and contact us if you have more questions.

Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Other releases:

Read more
Loading