
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@microxen/strapi-plugin-ckeditor
Advanced tools
[!IMPORTANT]
Starting from version 1.0.0, the CKEditor 5 custom field plugin is compatible with Strapi 5 and can’t be used in Strapi 4.4+. We decided to maintain integrations for both Strapi versions to ensure that you can still use our custom field before migrating to Strapi 5. Below is the compatibility table showing which plugin version should be used with your Strapi version.
This package provides a custom field for Strapi 5 that lets you use and configure CKEditor in no time.
Custom fields are supported since Strapi 4.4+ and offer powerful API to create highly customizable fields.
This is an official plugin, provided to you by the CKEditor team 👋
Inside your Strapi app, add the package:
With npm:
npm install @ckeditor/strapi-plugin-ckeditor
With yarn:
yarn add @ckeditor/strapi-plugin-ckeditor
Then, add the Content Security Policy configuration to allow loading CKEditor 5 from https://cdn.ckeditor.com origin, by adding the rule to config/middlewares.ts in your Strapi project root:
export default [
// ...
{
name: 'strapi::security',
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
'script-src': ['https://cdn.ckeditor.com']
},
},
},
},
// ...
Finally run build:
npm run build
or:
yarn build
This section covers the way how to configure your environment if you want to contribute to this package.
In order to start making changes in the plugin you first need to install Strapi infrastructure on top of the plugin repository.
npx create-strapi-app --quickstart strapi
cd strapi
By default Strapi does not create plugins folder so we need to create it.
mkdir -p src/plugins
Now we should clone this repository so we can work on it.
git clone git@github.com:ckeditor/strapi-plugin-ckeditor.git src/plugins/strapi-plugin-ckeditor
Let's add an entry inside ./package.json file so, we won't need to use yarn inside plugin itself.
"workspaces": ["./src/plugins/strapi-plugin-ckeditor"]
Install dependencies:
yarn install
Now we need to register plugin so strapi can use it. In order to do that we need
to create (if not already created) ./config/plugins.js file and add entry to it.
module.exports = ({ env }) => ({
ckeditor: {
enabled: true,
resolve: "./src/plugins/strapi-plugin-ckeditor"
},
});
Rebuild the project and start the server:
yarn build
yarn develop
Starting from version 1.0.0, the CKEditor 5 custom field plugin is compatible with Strapi 5 and can't be used in Strapi 4.4+. We decided to maintain integrations for both Strapi versions to make sure that you still be able to use our custom field before migrating to Strapi 5. Below, you can find the compatibility table that shows which plugin version should be used with your Strapi version.
| Plugin version | Strapi version |
|---|---|
| 1.x.x | ≥ 5.0.0 |
| 0.x.x | ≥ 4.4 |
The plugin "CKEditor 5 - Official Integration for Strapi" is licensed under MIT. Please note that CKEditor 5 itself is licensed under GPL v2+ or a commercial license.
FAQs
CKEditor 5 - Official Integration for Strapi
We found that @microxen/strapi-plugin-ckeditor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.