A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine, caused by a prototype pollution issue in the `es-toolkit` library. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming `style` attribute values. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS).
