CVE-2025-58064: CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package

September 3, 2025 (updated November 10, 2025)

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration.

References

github.com/advisories/GHSA-x9gp-vjh6-3wv6
github.com/ckeditor/ckeditor5
github.com/ckeditor/ckeditor5/commit/b210e90c6cf84e662ef6c7daf93a92355a961bf2
github.com/ckeditor/ckeditor5/security/advisories/GHSA-x9gp-vjh6-3wv6
nvd.nist.gov/vuln/detail/CVE-2025-58064

Code Behaviors & Features

Detect and mitigate CVE-2025-58064 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →