[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVdpw17Q9CYscAyd3ZyDiRxhaAIOOFZZrGnJ08qgyQ9w":3,"g5a-risk:CVE-2022-31175":127},{"success":4,"data":5,"meta":124},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":28,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":53,"references":54,"referencesCount":71,"weaknesses":72,"weaknessesCount":81,"isActivelyExploited":82,"cisaInfo":28,"otxData":28,"relatedBlogPosts":83,"seoMetadata":84,"configurations":109,"relatedVendorCves":122,"notableEvents":123},"CVE-2022-31175","What is CVE-2022-31175?","CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor\u002Fckeditor5-markdown-gfm`, `@ckeditor\u002Fckeditor5-html-support`, and `@ckeditor\u002Fckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization\u002Fdestroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.","CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versi...","2022-08-03T19:15:08.017","2022-08-09T17:28:44.367",4.7,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":28,"CVSSMetricV2":28,"CVSSMetricV40":28},[16,31],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":23,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","NETWORK","HIGH","NONE","REQUIRED","CHANGED","LOW","MEDIUM",null,1.6,2.7,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":29,"ImpactScore":37},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":35,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":36,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":26,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:L",5.8,3.7,0.00858,[38,38,38,38,38,38,38],"Medium",[42,47,50],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"ckeditor","ckeditor5-html-embed","*","cpe:2.3:a:ckeditor:ckeditor5-html-embed:*:*:*:*:*:node.js:*:*",{"vendor":43,"product":48,"version":45,"criteria":49,"vulnerable":4},"ckeditor5-html-support","cpe:2.3:a:ckeditor:ckeditor5-html-support:*:*:*:*:*:node.js:*:*",{"vendor":43,"product":51,"version":45,"criteria":52,"vulnerable":4},"ckeditor5-markdown-gfm","cpe:2.3:a:ckeditor:ckeditor5-markdown-gfm:*:*:*:*:*:node.js:*:*",3,[55,60,63,66],{"url":56,"source":57,"tags":58},"https:\u002F\u002Fckeditor.com\u002Fdocs\u002Fckeditor5\u002Flatest\u002Ffeatures\u002Fgeneral-html-support.html","Ckeditor",[59],"Vendor Advisory",{"url":61,"source":57,"tags":62},"https:\u002F\u002Fckeditor.com\u002Fdocs\u002Fckeditor5\u002Flatest\u002Ffeatures\u002Fhtml-embed.html",[59],{"url":64,"source":57,"tags":65},"https:\u002F\u002Fckeditor.com\u002Fdocs\u002Fckeditor5\u002Flatest\u002Ffeatures\u002Fmarkdown.html",[59],{"url":67,"source":68,"tags":69},"https:\u002F\u002Fgithub.com\u002Fckeditor\u002Fckeditor5\u002Fsecurity\u002Fadvisories\u002FGHSA-42wq-rch8-6f6j","GitHub",[70],"Third Party Advisory",4,[73],{"id":74,"name":75,"description":76,"extendedDescription":77,"status":78,"abstraction":79,"structure":80},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","Cross-site scripting (XSS) vulnerabilities occur when:\nThere are three main kinds of XSS:\nOnce the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site. Finally, the script could exploit a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes referred to as \"drive-by hacking.\"\nIn many cases, the attack can be launched without the victim even being aware of it. Even with careful users, attackers frequently use a variety of methods to encode the malicious portion of the attack, such as URL encoding or Unicode, so the request looks less suspicious.","Stable","Base","Simple",1,false,[],{"title":85,"metaDescription":86,"keywords":87,"canonicalUrl":88,"structuredData":89},"What is CVE-2022-31175? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-31175, a medium severity cyber security vulnerability from 2022. CKEditor 5 is a JavaScript rich text editor. A cross-site...","CVE-2022-31175, CVE-2022-31175 vulnerability, CVE-2022-31175 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, ckeditor security, ckeditor5-html-embed vulnerability, ckeditor5-html-support vulnerability, ckeditor5-markdown-gfm vulnerability","\u002Fwhat-is\u002Fcve-2022-31175",{"@context":90,"@type":91,"headline":85,"description":86,"datePublished":10,"dateModified":11,"author":92,"publisher":96,"about":100,"mainEntityOfPage":104,"articleSection":107,"keywords":108},"https:\u002F\u002Fschema.org","TechArticle",{"@type":93,"name":94,"url":95},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":93,"name":94,"url":95,"logo":97},{"@type":98,"url":99},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":101,"name":6,"description":102,"additionalType":103},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":105,"@id":106},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-31175","Cybersecurity","CVE-2022-31175, CVE-2022-31175 vulnerability, CVE-2022-31175 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[110],{"Operator":28,"Negate":28,"Nodes":111},[112],{"Operator":113,"Negate":28,"CPEMatch":114},"OR",[115,118,120],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":116,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":117,"VersionEndIncluding":28},"EE0D8A68-02CA-4BF9-AEFA-82B7531691CB","35.0.1",{"Vulnerable":4,"Criteria":49,"MatchCriteriaID":119,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":117,"VersionEndIncluding":28},"99D2554D-48FD-4E25-953A-9727C7C82DE5",{"Vulnerable":4,"Criteria":52,"MatchCriteriaID":121,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":117,"VersionEndIncluding":28},"F2437399-6A77-4BB7-8028-59E948BFED95",[],[],{"lastModified":11,"cacheTime":125,"version":126},1792265569363,"2.0",{"score":128,"band":129,"action":130,"scoredAt":131},20,"Low","Monitor","2026-10-16T06:55:18.186572+00:00"]