Is CVE-2024-45613 actively exploited?

No active exploitation of CVE-2024-45613 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-45613 be exploited remotely?

Yes. CVE-2024-45613 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-45613?

CVE-2024-45613 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2024-45613

MEDIUM

CVE-2024-45613

CWE-79Published: September 25, 2024· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.

NVD Source

Technical Analysis

CVE-2024-45613 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.