CVE-2024-45613

What it actually does

Cross-Site Scripting (XSS) in the clipboard package allows unauthorized JavaScript execution when malicious content is inserted into the editor under specific configurations (Block Toolbar enabled plus General HTML Support with unsafe markup or HTML Embed plugin).

Why it matters to the business

Applications embedding the editor face risk of script execution in user browsers, potentially leading to session hijacking, data exfiltration, or unauthorized actions; the issue affects widely used downstream projects such as XWiki with remediation deadlines adding operational urgency.

How an attack unfolds

An attacker prepares malicious markup permitted by the enabled HTML support or embed features, delivers it for insertion into the editor (e.g., via clipboard), and relies on a victim performing a specific action with the Block Toolbar to trigger execution of the injected script.

How to fix it

Upgrade CKEditor 5 to version 43.1.1 or later; for XWiki apply the fixed versions 13.7-rc-1, 13.4.3 or 12.10.9; as a temporary mitigation disable the Block Toolbar plugin.

How to confirm the fix worked

Verify the editor version against the fixed release or commit 6b1e550ba3eee4618f36258ee2ed7cbbc2361246, confirm the Block Toolbar plugin is either removed or the unsafe HTML configuration is disabled, and retest editor input handling with known malicious payloads.

Typical attack path

1. Identify a target application using a vulnerable CKEditor 5 version with the required plugin combination enabled
2. Craft and deliver malicious content containing executable script via clipboard or editor input
3. Induce the victim to perform the specific user action involving the Block Toolbar
4. Execute arbitrary JavaScript in the victim's browser context

How to detect it

Review application logs for unexpected script execution or clipboard events involving the Block Toolbar plugin, inspect stored editor content for suspicious markup patterns, and correlate with user reports of unexpected behavior in rich-text fields.

What your security team should do

• Immediately inventory all deployments of CKEditor 5 and dependent products such as XWiki to identify vulnerable instances
• Prioritize upgrade to the fixed versions listed for each affected package
• Audit editor configurations to disable Block Toolbar or restrict unsafe HTML support where possible
• Monitor EPSS trend and re-evaluate exploit maturity as new information emerges