CKEditor 5 Markdown plugin Regular expression Denial of Service
Moderate severity
GitHub Reviewed
Published
Jan 28, 2021
in
ckeditor/ckeditor5
•
Updated Jan 30, 2023
Description
Reviewed
Jan 29, 2021
Published to the GitHub Advisory Database
Jan 29, 2021
Published by the National Vulnerability Database
Jan 29, 2021
Last updated
Jan 30, 2023
Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0.
Patches
The problem has been recognized and patched. The fix will be available in version 25.0.0.
Workarounds
The user can work around the issue by:
More information
If you have any questions or comments about this advisory:
Acknowledgements
The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and
Alvaro Muñoz from GitHub for reporting it.
References