Sourced from ckeditor5's releases.
v43.1.1
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-editor-balloon
: v43.1.0 => v43.1.1
... (truncated)
Sourced from ckeditor5's changelog.
43.1.1 (September 25, 2024)
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1
... (truncated)
6b1e550
Release: v43.1.1.e63d992
Merge pull request #17148 from ckeditor/release_to_release2c43f71
Merge pull request #17113 from ckeditor/ck/fix-selection-hang-test9c2d297
Changelog for v43.1.1.84cdd9c
Release: v43.1.0.b32ee03
Merge pull request #17034 from ckeditor/revert-16878-ci/16870-sanitize-htmlde4a416
Docs: minor fix. [skip ci]1eff562
Updated CHANGELOG.md. [short flow]b2021fa
Update docs/updating/update-to-43.mdaeafee9
Update docs/updating/update-to-43.mdSourced from @ckeditor/ckeditor5-build-classic
's releases.
v43.1.1
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-editor-balloon
: v43.1.0 => v43.1.1
... (truncated)
Sourced from @ckeditor/ckeditor5-build-classic
's changelog.
43.1.1 (September 25, 2024)
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1
... (truncated)
6b1e550
Release: v43.1.1.84cdd9c
Release: v43.1.0.fe96879
Internal (build-*): Builds. [skip ci]5804ae9
Internal (build-*): Builds.a0ac4f4
Release: v43.0.0.739f712
Internal (build-*): Builds.fc38c1b
Internal (build-*): Builds.e1037ef
Internal (build-*): Builds.6ecf5f7
Internal (build-*): Builds.f0e0db6
Changed global name for ckeditor5 for umd build and bump ckeditor5-dev-* to t...Sourced from @ckeditor/ckeditor5-code-block
's releases.
v43.1.1
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-editor-balloon
: v43.1.0 => v43.1.1
... (truncated)
Sourced from @ckeditor/ckeditor5-code-block
's changelog.
43.1.1 (September 25, 2024)
We are happy to announce the release of CKEditor 5 v43.1.1.
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package (
CVE-2024-45613
). This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert malicious content into the editor, which might happen with a very specific editor configuration.This vulnerability affects only installations where the editor configuration meets the following criteria:
- The Block Toolbar plugin is enabled.
- One of the following plugins is also enabled:
- General HTML Support with a configuration that permits unsafe markup.
- HTML Embed.
You can read more details in the relevant security advisory and contact us if you have more questions.
Taking the occasion, we decided to introduce additional hardening to some parts of our codebase that introduce theoretical and unexploitable issues. Our security team confirmed that none of these issues were exploitable in a real scenario, however, we decided to fix them, in order to increase the overall security posture of our software.
Released packages
Check out the Versioning policy guide for more information.
Other releases:
@ckeditor/ckeditor5-adapter-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ai
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-alignment
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autoformat
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-autosave
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-basic-styles
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-block-quote
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-balloon-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-classic
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-decoupled-document
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-inline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-build-multi-root
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-case-change
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckbox
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-ckfinder
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-clipboard
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-cloud-services
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-code-block
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-collaboration-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-comments
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-core
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-document-outline
: v43.1.0 => v43.1.1@ckeditor/ckeditor5-easy-image
: v43.1.0 => v43.1.1
... (truncated)
6b1e550
Release: v43.1.1.84cdd9c
Release: v43.1.0.a0ac4f4
Release: v43.0.0.28bf325
Other: Updated translations. [skip ci]4a8ca46
Other: Updated translations. [skip ci]5221aca
Merge pull request #16813 from ckeditor/cc/merge-fields-fixese66ff8a
Add missing code block test for a change in attributes rules.181d785
Disallow formatting attributes on nodes inside code block (CC#6454).f0e0db6
Changed global name for ckeditor5 for umd build and bump ckeditor5-dev-* to t...f427572
Resolved issues with dependencies.