⚠️️️ Please note that this release is a part of CKEditor 4 Extended Support Model, only available to customers who decided to acquire the LTS (Long Term Support) version of the editor. All editor versions below 4.25.0-lts can no longer be considered as secure! ⚠️

Security Updates:

• Fixed reflected cross-site scripting (XSS) vulnerability in Code Snippet GeSHi plugin reported by Jiasheng He from Qihoo 360.

  Issue summary: The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. See GHA for more details.

• Fixed low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

  Issue summery: A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices. See GHA for more details.

You can read more details in the relevant security advisories. Contact us if you have more questions.

An upgrade is highly recommended!

Updated dependencies:

• CodeMirror (used only in the Toolbar Configurator in samples) has been updated to v5.65.17 for improved stability and performance.

• Highlight.js (used by the Code Snippet plugin) has been updated to v11.9.0, introducing two breaking changes:

  • dropped support for Internet Explorer,
  • updated list of the supported themes – some of the themes are no longer officially supported, others may have their names changed (e.g. monokai_sublime is now monokai-sublime). Please verify the value of your config.codeSnippet_theme configuration option and adjust theme names as needed. The list of available themes can be checked in the plugins/codesnippet/lib/highlight/styles directory.

This release introduces the LTS (”Long Term Support”) version of the editor, available under commercial terms ("Extended Support Model").

If you acquired the Extended Support Model for CKEditor 4 LTS, please read the CKEditor 4 LTS key activation guide.