CVE:CVE-2022-31175
CNNVD:CNNVD-202208-2127
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor5 35.0.1之前存在跨站脚本漏洞，该漏洞源于在销毁编辑器后使用来自 CKEditor 5 数据管道的标记更新源元素。
solution:Upgrade ckeditor ckeditor5-html-embed to a higher version than 35.0.1,and avoid the version (,35.0.1); Upgrade ckeditor ckeditor5-html-support to a higher version than 35.0.1,and avoid the version (,35.0.1); Upgrade ckeditor ckeditor5-markdown-gfm to a higher version than 35.0.1,and avoid the version (,35.0.1)