Vulnerability advisory

CVE-2021-41164

Published Nov 17, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-drupal-2021-41164GHSA-pvmx-g8h5-cprj

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
769d96134bcf29f5d3d870e25797ce9b9dc8289e to before cab78d432999c8bcd8213a2e0786026a5f9a44dc	`cab78d432999c8bcd8213a2e0786026a5f9a44dc`
Also listed as affected (24) `4.16.0` `4.15.0` `4.14.0` `4.13.0` `4.12.0` `4.10.0` `4.8.0` `4.7.0` `4.6.0` `4.5.0` `4.5.0-beta` `4.4.1` `4.4.0` `4.2.3` `4.2.2` `4.2.1` `4.2.0` `4.2` `4.1.0` `4.1` `4.1rc` `4.0.1` `4.0.0` `4.0`
GIT github.com/ckeditor/ckeditor4-releases ↗
870a561110a23435d78eda377400dca7f64d3bd3 to before 5a0d3c84b4bc9eb7d1ecd8dfa9b660eb691553c2	`5a0d3c84b4bc9eb7d1ecd8dfa9b660eb691553c2`
Also listed as affected (67) `standard/4.16.2` `standard/4.16.1` `standard/4.16.0` `standard/4.15.1` `standard/4.15.0` `standard/4.14.1` `standard/4.14.0` `standard/4.13.1` `standard/4.13.0` `standard/4.12.1` `standard/4.12.0` `standard/4.11.4` `standard/4.11.3` `standard/4.11.2` `standard/4.11.1` `standard/4.11.0` `standard/4.10.1` `standard/4.10.0` `standard/4.9.2` `standard/4.9.1` `standard/4.9.0` `standard/4.8.0` `standard/4.7.3` `standard/4.7.2` `standard/4.7.1` `standard/4.7.0` `standard/4.6.2` `standard/4.6.1` `standard/4.6.0` `standard/4.5.11` `standard/4.5.10` `standard/4.5.9` `standard/4.5.8` `standard/4.5.7` `standard/4.5.6` `standard/4.5.5` `standard/4.5.4` `standard/4.5.3` `standard/4.5.2` `standard/4.5.1` `standard/4.5.0` `standard/4.4.8` `standard/4.4.7` `standard/4.4.6` `standard/4.4.5` `standard/4.4.4` `standard/4.4.3` `standard/4.4.2` `standard/4.4.1` `standard/4.4.0` `standard/4.3.5` `standard/4.3.4` `standard/4.3.3` `4.3.2/standard` `4.3.1/standard` `4.3.0/standard` `4.2.3/standard` `4.2.2/standard` `4.2.1/standard` `4.2/standard` `4.1.3/standard` `4.1.2/standard` `4.1.1/standard` `4.1/standard` `4.1rc/standard` `4.0.1/standard` `4.0/standard`
GIT github.com/drupal/drupal ↗
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before e187f925ed6aa9d9d4b3121904c077aa54ba108a	`e187f925ed6aa9d9d4b3121904c077aa54ba108a`
5c6f14f762c9aef87cd2731818386f202ee8463c to before 0398571aae84442c8fad6e9ce307aefb8c293b20	`0398571aae84442c8fad6e9ce307aefb8c293b20`
943ecef3c0bc9822338252a7df6419aeb9253c9d to before ae75f828134e57bb1aed2ffb2635e6b28fc0e040	`ae75f828134e57bb1aed2ffb2635e6b28fc0e040`
Also listed as affected (30) `8.9.19` `9.1.13` `9.2.8` `9.2.7` `8.9.18` `9.1.12` `9.2.5` `8.9.17` `9.1.11` `9.2.3` `8.9.16` `9.1.10` `9.2.1` `9.2.0` `9.1.8` `8.9.15` `9.1.6` `9.1.5` `9.1.4` `8.9.12` `9.1.2` `9.1.1` `8.9.11` `9.1.0` `8.9.8` `8.9.5` `8.9.4` `8.9.3` `8.9.2` `8.9.0`

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

CVE-2021-41164

Affected versions

Repository

Description

References