Threats tagged 'ghsa-v6mg-96c6-gmpq'

A Cross-Site Scripting (XSS) vulnerability exists in CKEditor 5 engine versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1. This issue occurs when the General HTML Support feature is enabled and configured to allow certain HTML content, enabling injection of malicious JavaScript code in a browser context isolated from the embedding application's origin. The vulnerability has a low severity score and has been patched in versions 47.7.4 and 48.5.1.