CVE-2025-61261

5.4

MEDIUMCVSS v3

Published

November 7, 2025

Affected

11 projects

Assigned by

MITRE

Severity scale

010

Description

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

angular/angular

GitHubDeliver web apps with confidence 🚀

= 18.0.0NVD

angular

NPMHTML enhanced for web apps

= 18.0.0NVD

@uirouter/angular

NPM

More on this CVE

NVD↗GitHub Advisory↗

State-based routing for Angular

= 18.0.0NVD

@types/angular

NPMTypeScript definitions for angular

= 18.0.0NVD

@storybook/angular

NPMStorybook for Angular: Develop, document, and test UI components in isolation

= 18.0.0NVD

@schematics/angular

NPMSchematics specific to Angular

= 18.0.0NVD

ui-router/angular

GitHubUI-Router for Angular: State-based routing for Angular (v2+)

= 18.0.0NVD

ckeditor/ckeditor5

GitHubPowerful rich text editor framework with a modular architecture, modern integrations, and features like collaborative editing.

= 46.1.0NVD

angular

Crates.ioAngular types and common helper methods.

= 18.0.0NVD

ckeditor5

NPMA set of ready-to-use rich text editors created with a powerful framework. Made with real-time collaborative editing in mind.

= 46.1.0NVD

ckeditor5

RubyGemsCKEditor 5 for Rails

= 46.1.0NVD

Security Advisories

CVE-2025-61261

Description

More on this CVE