GHSA-hgmg-hhc8-g5wr
CKEditor 5 Markdown plugin Regular expression Denial of Service
Quick fix
GHSA-hgmg-hhc8-g5wr — @ckeditor/ckeditor5-markdown-gfm: upgrade to the fixed version with the command below.
npm install @ckeditor/ckeditor5-markdown-gfm@25.0.0Details
### Impact A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0.
### Patches The problem has been recognized and patched. The fix will be available in version 25.0.0.
### Workarounds The user can work around the issue by: - Upgrading CKEditor 5 to version 25.0.0. - Disabling the Markdown plugin.
### More information If you have any questions or comments about this advisory: * Email us at [security@cksource.com](mailto:security@cksource.com)
### Acknowledgements The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and Alvaro Muñoz from GitHub for reporting it.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 25.0.0npm install @ckeditor/ckeditor5-markdown-gfm@25.0.0References
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2021-21254[ADVISORY]
- https://github.com/ckeditor/ckeditor5[PACKAGE]
- https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0[WEB]
- https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm[WEB]