DemoBook a demo

Vulnerability advisory

CVE-2020-27193

Published Updated OSV record ↗

Also known as GHSA-4m44-5j2g-xf64

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
cc4885b5311fed18d9931da236c1ef7f7146da9a through cc4885b5311fed18d9931da236c1ef7f7146da9aNo fix listed
Also listed as affected (1)
  • 4.15.0
GIT github.com/ckeditor/ckeditor4-releases ↗
4b62201908d6a007ffbad972e4c3828e049a2ce8 through 4b62201908d6a007ffbad972e4c3828e049a2ce8No fix listed
Also listed as affected (2)
  • 4.15.0
  • standard/4.15.0

Description

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.