Sourced from ckeditor4's\r\nchangelog.
\r\n\r\n\r\n⚠️️️ CKEditor 4 (the open source edition) is no longer\r\nmaintained. ⚠️
\r\nIf you would like to keep access to future CKEditor 4 security\r\npatches, check the Extended Support\r\nModel, which guarantees security updates and critical bug\r\nfixes until December 2026. Alternatively, upgrade\r\nto CKEditor 5.
\r\nCKEditor 4.25.0-lts
\r\n⚠️️️ Please note that this release is a part of CKEditor 4 Extended\r\nSupport Model, only available to customers who decided to acquire\r\nthe LTS (Long Term Support) version of the editor. All editor\r\nversions below 4.25.0-lts can no longer be considered as\r\nsecure! ⚠️
\r\nSecurity Updates:
\r\n\r\n
\r\n- \r\n
\r\nFixed reflected cross-site scripting (XSS) vulnerability in Code Snippet\r\nGeSHi plugin reported by Jiasheng He from Qihoo 360.
\r\nIssue summary: The vulnerability allowed a reflected XSS attack by\r\nexploiting a flaw in the GeSHi syntax highlighter\r\nlibrary hosted by the victim. The GeSHi library was included as a\r\nvendor dependency in CKEditor 4 source files. In a specific scenario, an\r\nattacker could craft a malicious script that could be executed by\r\nsending a request to the GeSHi library hosted on a PHP web server. See\r\nGHA\r\nfor more details.
\r\n- \r\n
\r\nFixed low-risk cross-site scripting (XSS) vulnerability linked to\r\npotential domain takeover
\r\nIssue summery: A theoretical vulnerability has been identified in\r\nCKEditor 4.22 (and above). In a highly unlikely scenario where an\r\nattacker gains control over the https://cke4.ckeditor.com domain,\r\nthey could potentially execute an attack on CKEditor 4 instances.\r\nAlthough the vulnerability is purely hypothetical, we have addressed it\r\nin CKEditor 4.25.0-lts to ensure compliance with security best\r\npractices. See GHA\r\nfor more details.
\r\nYou can read more details in the relevant security advisories. Contact\r\nus if you have more questions.
\r\nAn upgrade is highly recommended!
\r\nUpdated dependencies:
\r\n\r\n
\r\n- \r\n
\r\nCodeMirror (used only in the Toolbar\r\nConfigurator in samples) has been updated to v5.65.17 for improved\r\nstability and performance.
\r\n- \r\n
\r\nHighlight.js (used by the Code Snippet\r\nplugin) has been updated to v11.9.0, introducing two breaking\r\nchanges:
\r\n\r\n
\r\n- dropped support for Internet Explorer,
\r\n- updated list of the supported themes – some of the themes are no\r\nlonger officially supported, others may have their names changed (e.g.\r\n
\r\nmonokai_sublime
is nowmonokai-sublime
).\r\nPlease verify the value of yourconfig.codeSnippet_theme
\r\nconfiguration option and adjust theme names as needed. The list of\r\navailable themes can be checked in the\r\nplugins/codesnippet/lib/highlight/styles
directory.CKEditor 4.24.0-lts
\r\n⚠️️️ Please note that this release is a part of CKEditor 4 Extended\r\nSupport Model, only available to customers who decided to acquire\r\nthe LTS (Long Term Support) version of the editor. All editor\r\nversions below 4.24.0-lts can no longer be considered as\r\nsecure! ⚠️
\r\nSecurity Updates:
\r\n\r\n
\r\n- \r\n
\r\nFixed cross-site scripting (XSS) vulnerability caused by incorrect\r\nCDATA detection reported by Michal Frýba, ALEF NULA.
\r\nIssue summary: The vulnerability allowed to inject malformed HTML\r\ncontent bypassing Advanced Content Filtering mechanism, which could\r\nresult in executing JavaScript code. See GHA\r\nfor more details.
\r\n- \r\n
\r\nFixed cross-site scripting (XSS) vulnerability in AJAX sample\r\nreported by Rafael Pedrero, see INCIBE\r\nreport.
\r\nIssue summary: The vulnerability allowed to execute JavaScript code\r\nby abusing the AJAX sample. See GHA\r\nfor more details.
\r\n- \r\n
\r\nCross-site scripting (XSS) vulnerability in samples with enabled the\r\npreview feature reported by Marcin\r\nWyczechowski & Michał\r\nMajchrowicz AFINE Team.
\r\nIssue summary: The vulnerability allowed to execute JavaScript code\r\nby abusing the misconfigured preview feature. See GHA\r\nfor more details.
\r\nYou can read more details in the relevant security advisories. Contact\r\nus if you have more questions.
\r\n\r\n
... (truncated)
\r\n