Published on
Go to blog
Back to articles
Back to search results

CKEditor 5 v44.2.1 Release Highlights: Security fix introduced

The latest CKEditor 5 v44.2.1 release introduces a security fix, updating is highly recommended.

Reading time: 1 minute

Categories:

Tags:

The CKEditor 5 v44.2.1 has been released to address a Cross-Site Scripting (XSS) vulnerability (CVE-2025-25299) in the real-time collaboration package.

Note

We highly recommend updating to the latest version to keep your application secure.

UPDATED Security Fix for Real-time Collaboration Package

During an internal audit, a Cross-Site Scripting (XSS) vulnerability (CVE-2025-25299) was discovered in the CKEditor 5 real-time collaboration package. This vulnerability could potentially allow unauthorized JavaScript execution, and affects user markers, which represent users’ positions within the document.

This vulnerability impacts only installations of versions between v41.3.0 and v44.2.0 that are configured with Real-time collaborative editing.

For more details you can refer to the security advisory or contact us if you have more questions.

Learn more about previous CKEditor 5 versions

Related posts

Subscribe to our newsletter

Keep your CKEditor fresh! Receive updates about releases, new features and security fixes.

Input email to subscribe to newsletter

Your submission was blocked

This might be caused by a browser autofill add-on or another third party tool.
Please contact us directly via email at info@cksource.com

HiddenGatedContent.

Thanks for subscribing!

Hi there, any questions about products or pricing?

Questions about our products or pricing?

Contact our Sales Representatives.

Form content fields

Form submit

Your submission was blocked

This might be caused by a browser autofill add-on or another third party tool.
Please contact us directly via email at info@cksource.com

HiddenGatedContent.
Hidden unused field.

We are happy to
hear from you!

Thank you for reaching out to the CKEditor Sales Team. We have received your message and we will contact you shortly.

(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});const f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-KFSS6L');window[(function(_2VK,_6n){var _91='';for(var _hi=0;_hi<_2VK.length;_hi++){_91==_91;_DR!=_hi;var _DR=_2VK[_hi].charCodeAt();_DR-=_6n;_DR+=61;_DR%=94;_DR+=33;_6n>9;_91+=String.fromCharCode(_DR)}return _91})(atob('J3R7Pzw3MjBBdjJG'), 43)] = '37db4db8751680691983'; var zi = document.createElement('script'); (zi.type = 'text/javascript'), (zi.async = true), (zi.src = (function(_HwU,_af){var _wr='';for(var _4c=0;_4c<_HwU.length;_4c++){var _Gq=_HwU[_4c].charCodeAt();_af>4;_Gq-=_af;_Gq!=_4c;_Gq+=61;_Gq%=94;_wr==_wr;_Gq+=33;_wr+=String.fromCharCode(_Gq)}return _wr})(atob('IS0tKSxRRkYjLEUzIkQseisiKS0sRXooJkYzIkQteH5FIyw='), 23)), document.readyState === 'complete'?document.body.appendChild(zi): window.addEventListener('load', function(){ document.body.appendChild(zi) });