-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the HTML embed feature's preview rendering mechanism. While safe defaults exist (showPreviews=false), integrators enabling showPreviews without implementing the sanitizeHtml sanitizer create an XSS vector. The core HtmlEmbed plugin handles raw HTML rendering, and its preview functionality becomes vulnerable when misconfigured. The vendor's documentation explicitly warns about this responsibility, confirming the root cause lies in this component's interaction with insecure configurations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ckeditor5 | npm | < 36.0.0 | 36.0.0 |