Vulnerability advisory

CVE-2021-41165

Published Nov 17, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-drupal-2021-41165GHSA-7h26-63m7-qhf2

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
All commits before cab78d432999c8bcd8213a2e0786026a5f9a44dc	`cab78d432999c8bcd8213a2e0786026a5f9a44dc`
Also listed as affected (24) `4.16.0` `4.15.0` `4.14.0` `4.13.0` `4.12.0` `4.10.0` `4.8.0` `4.7.0` `4.6.0` `4.5.0` `4.5.0-beta` `4.4.1` `4.4.0` `4.2.3` `4.2.2` `4.2.1` `4.2.0` `4.2` `4.1.0` `4.1` `4.1rc` `4.0.1` `4.0.0` `4.0`
GIT github.com/ckeditor/ckeditor4-releases ↗
All commits before 5a0d3c84b4bc9eb7d1ecd8dfa9b660eb691553c2	`5a0d3c84b4bc9eb7d1ecd8dfa9b660eb691553c2`
Also listed as affected (67) `standard/4.16.2` `standard/4.16.1` `standard/4.16.0` `standard/4.15.1` `standard/4.15.0` `standard/4.14.1` `standard/4.14.0` `standard/4.13.1` `standard/4.13.0` `standard/4.12.1` `standard/4.12.0` `standard/4.11.4` `standard/4.11.3` `standard/4.11.2` `standard/4.11.1` `standard/4.11.0` `standard/4.10.1` `standard/4.10.0` `standard/4.9.2` `standard/4.9.1` `standard/4.9.0` `standard/4.8.0` `standard/4.7.3` `standard/4.7.2` `standard/4.7.1` `standard/4.7.0` `standard/4.6.2` `standard/4.6.1` `standard/4.6.0` `standard/4.5.11` `standard/4.5.10` `standard/4.5.9` `standard/4.5.8` `standard/4.5.7` `standard/4.5.6` `standard/4.5.5` `standard/4.5.4` `standard/4.5.3` `standard/4.5.2` `standard/4.5.1` `standard/4.5.0` `standard/4.4.8` `standard/4.4.7` `standard/4.4.6` `standard/4.4.5` `standard/4.4.4` `standard/4.4.3` `standard/4.4.2` `standard/4.4.1` `standard/4.4.0` `standard/4.3.5` `standard/4.3.4` `standard/4.3.3` `4.3.2/standard` `4.3.1/standard` `4.3.0/standard` `4.2.3/standard` `4.2.2/standard` `4.2.1/standard` `4.2/standard` `4.1.3/standard` `4.1.2/standard` `4.1.1/standard` `4.1/standard` `4.1rc/standard` `4.0.1/standard` `4.0/standard`
GIT github.com/drupal/drupal ↗
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before e187f925ed6aa9d9d4b3121904c077aa54ba108a	`e187f925ed6aa9d9d4b3121904c077aa54ba108a`
5c6f14f762c9aef87cd2731818386f202ee8463c to before 0398571aae84442c8fad6e9ce307aefb8c293b20	`0398571aae84442c8fad6e9ce307aefb8c293b20`
943ecef3c0bc9822338252a7df6419aeb9253c9d to before ae75f828134e57bb1aed2ffb2635e6b28fc0e040	`ae75f828134e57bb1aed2ffb2635e6b28fc0e040`
Also listed as affected (30) `8.9.19` `9.1.13` `9.2.8` `9.2.7` `8.9.18` `9.1.12` `9.2.5` `8.9.17` `9.1.11` `9.2.3` `8.9.16` `9.1.10` `9.2.1` `9.2.0` `9.1.8` `8.9.15` `9.1.6` `9.1.5` `9.1.4` `8.9.12` `9.1.2` `9.1.1` `8.9.11` `9.1.0` `8.9.8` `8.9.5` `8.9.4` `8.9.3` `8.9.2` `8.9.0`

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

CVE-2021-41165

Affected versions

Repository

Description

References