npm / PACKAGE INTELLIGENCE

ckeditor-dev

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

The development version of CKEditor - JavaScript WYSIWYG web text editor.

Latest release4.12.1

Declared license(GPL-2.0-or-later OR LGPL-2.1 OR MPL-1.1)

Listed maintainersckeditor, cksource

Runtime dependencies0

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationWe have renamed the @ckeditor-dev package. New versions are available under the @ckeditor4-dev name.

Fetched 27/10/2026, 20:44:26 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.1

GHSA-g78h-pf65-46rvFix available

Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

14 May

ckeditor-dev npm

Semantic versions

From 4.5.10 before 4.9.2

Fixed in 4.9.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "4.5.10"
        },
        {
          "fixed": "4.9.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}