Support for CKEditor 4.9.2

For reference, the CKEditor 4 release notes indicate that the XSS vulnerably is with the Enhanced Image plugin (image2).

Reviewing the diff of 4.9.1 and 4.9.2, I don't see any changes to the image2 code. The only actual code change I see is in aab10e3. If that is the fix, a simple patch could protect older versions using image2. But I have no idea if that really is the fix since info around the vulnerability is sparse.

According to the CKEditor CHANGELOG this is an issue in a plugin that does not ship with the Basic/Full/Standard presets. https://github.com/ckeditor/ckeditor-dev/commit/95e5d83ee97d4581230ba5a9...

Will updating to 4.9.2 actually break anything, or is it just going to result in that "Wysiwyg was only able to adapt the profile to editor version" warning message?

Thank you for the ping.
There were already two issues open about this so I'm merging the change with the patches there.
There will be a release to mark 4.9.2 tested within a short moment.
Updating to this new version will not break anything.

@darby3 You will not see that message unless you are upgrading from an earlier version which required changes to the editor profile.
There have been no such changes needed recently so it will likely just change to be listed as verified.

Update: It does indeed look like the vulnerable plugin is not shipped with the Full profile (the only one supported by Wysiwyg out of the box), however I do know some people are using the available hooks to declare support for it, and making a release with this note in it may at least draw their attention.

This is awesome. Thank you so much!!!

Just a note: The supported editors matrix page (https://www.drupal.org/node/596966) probably should be updated to reflect this change. It now say the highest supported CKEditor version is 4.6.2.

Yep, I was too tired to do that as well yesterday. If you feel like doing it please go ahead, it's a wiki page after all. :)
Otherwise I'll pick it up later this evening.

Just a note. Updating from 4.6.x to 4.9.x will introduce this issue https://github.com/ckeditor/ckeditor-dev/issues/469