Vulnerabilities in pkg:npm/ckeditor5-premium-features

PACKAGE
Advisory Identifier: GHSA-j3mm-wmfm-mwvh
Share
Advisory Summary

CVE-2025-25299 is a MODERATE cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting @ckeditor/ckeditor5 real time collaboration libraries in the npm ecosystem. The issue involves cross-site scripting (xss) in the ckeditor 5 real-time collaboration package. Remediation is available by upgrading affected packages to version 44.2.1.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/ckeditor5-premium-features

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/ckeditor5-premium-features. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-j3mm-wmfm-mwvh CVE-2025-25299 MODERATE Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package

CVE-2025-25299 at a Glance

CVE Identifier CVE-2025-25299
GHSA Identifier GHSA-j3mm-wmfm-mwvh
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product @ckeditor/ckeditor5 real time collaboration
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2025-25299

To remediate this vulnerability, upgrade all affected @ckeditor/ckeditor5 real time collaboration dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@ckeditor/ckeditor5-real-time-collaboration fixed: 44.2.1 
npm install @ckeditor/ckeditor5-real-time-collaboration@44.2.1
ckeditor5-premium-features fixed: 44.2.1 
npm install ckeditor5-premium-features@44.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @ckeditor/ckeditor5-real-time-collaboration

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-25299, inspect your project dependencies using npm:

npm ls @ckeditor/ckeditor5-real-time-collaboration

Analyze the terminal output to locate any version of @ckeditor/ckeditor5 real time collaboration in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 44.2.1), your application is affected.

Note: The npm ls @ckeditor/ckeditor5-real-time-collaboration command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In @ckeditor/ckeditor5 real time collaboration, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document. This vulnerability affects only installations with [Real-time collaborative editing](https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html) enabled. ### Patches The problem has been recognized and patched. The fix will be available in version 44.2.1 (and above). ### For more information Email us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.

CVE-2025-25299 Affected @ckeditor/ckeditor5 real time collaboration Versions

2 component(s)
Fixed Versions:
44.2.1
Product / Package Ecosystem Affected Versions Fixed Version
@ckeditor/ckeditor5-real-time-collaboration
npm/@ckeditor/ckeditor5-real-time-collaboration
npm
≥ 41.3.0
< 44.2.1
44.2.1
ckeditor5-premium-features
npm/ckeditor5-premium-features
npm
≥ 42.0.0
< 44.2.1
44.2.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh
NVD — CVE-2025-25299 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25299
ckeditor.com/docs/ckeditor5/late... WEB
https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html
ckeditor.com/docs/ckeditor5/late... WEB
https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dca024c9b4e44aef039f99ebe6c664
@ckeditor/ckeditor5 real time collaboration Source Repository REPOSITORY
https://github.com/ckeditor/ckeditor5
@ckeditor/ckeditor5 real time collaboration Release RELEASE
https://github.com/ckeditor/ckeditor5/releases/tag/v44.2.1

Frequently Asked Questions

What is CVE-2025-25299?
CVE-2025-25299 is a security vulnerability in @ckeditor/ckeditor5 real time collaboration involving Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which @ckeditor/ckeditor5 real time collaboration versions are affected?
Affected versions include releases prior to 44.2.1 across affected packages: @ckeditor/ckeditor5-real-time-collaboration, ckeditor5-premium-features.
What version fixes CVE-2025-25299?
Upgrading to 44.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @ckeditor/ckeditor5-real-time-collaboration affected?
Yes, @ckeditor/ckeditor5-real-time-collaboration is affected in releases prior to 44.2.1. Upgrade your dependency to 44.2.1 or later.
Is ckeditor5-premium-features affected?
Yes, ckeditor5-premium-features is affected in releases prior to 44.2.1. Upgrade your dependency to 44.2.1 or later.
What CWE is associated with CVE-2025-25299?
CVE-2025-25299 is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check npm dependencies for CVE-2025-25299?
Run the dependency tree command: 'npm ls @ckeditor/ckeditor5-real-time-collaboration'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j3mm-wmfm-mwvh",
  "modified" : "2025-02-20T22:53:45Z",
  "published" : "2025-02-20T20:16:31Z",
  "aliases" : [ "CVE-2025-25299" ],
  "summary" : "Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package",
  "details" : "### Impact\nDuring a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.\n\nThis vulnerability affects only installations with [Real-time collaborative editing](https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html) enabled.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 44.2.1 (and above).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@ckeditor/ckeditor5-real-time-collaboration"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "41.3.0"
      }, {
        "fixed" : "44.2.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 44.2.0"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "ckeditor5-premium-features"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "42.0.0"
      }, {
        "fixed" : "44.2.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 44.2.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-25299"
  }, {
    "type" : "WEB",
    "url" : "https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html"
  }, {
    "type" : "WEB",
    "url" : "https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dca024c9b4e44aef039f99ebe6c664"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ckeditor/ckeditor5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ckeditor/ckeditor5/releases/tag/v44.2.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-80" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-02-20T20:16:31Z",
    "nvd_published_at" : "2025-02-20T20:15:46Z"
  }
}