CVE-2022-31175: 
JavaScript vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered affecting three optional CKEditor 5 packages (@ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and @ckeditor/ckeditor5-html-embed) in versions prior to 35.0.1. The vulnerability was discovered on August 3, 2022 (NIST, GitHub Advisory).

The vulnerability allowed triggering JavaScript code execution under specific conditions: 1) Using one of the affected packages (for html-support and html-embed packages, configuration allowing unsafe markup was required), 2) Initializing the editor on an element and using an element other than as a base, and 3) Destroying the editor instance. The root cause was identified in the mechanism responsible for updating the source element with markup from the CKEditor 5 data pipeline after destroying the editor (GitHub Advisory).

This vulnerability could potentially affect a small percentage of integrators that depend on dynamic editor initialization/destroy functionality and use Markdown, General HTML Support, or HTML embed features. The impact allows for potential execution of malicious JavaScript code under specific conditions (GitHub Advisory).

The vulnerability has been patched in version 35.0.1. Users are advised to upgrade to this version or later to address the security issue. There are no known workarounds for this vulnerability (GitHub Advisory).