CVE-2023-28439 (ckeditor)

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators …

base code conditions configuration content security cross-site cve dialog editor html iframe instance javascript may media missing open source packages policy scripting security security policy special trigger vulnerability web