A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0…
Priority LOW 34CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Why it matters now
EPSS 0.04308 91st percentileScored 2026-11-07
Fix Fixed ckeditor4 (npm): 4.14.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | ckeditor4 (npm) | before 4.14.0 | 4.14.0 | Patch available | GHSA-vcjf-mgcg-jxjq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- ckeditor4 (npm) Vendor— Affected before 4.14.0 Fixed in 4.14.0 Patch available GHSA-vcjf-mgcg-jxjq
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* | 4.0 to before 4.14 | Vulnerable | ckeditor |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | 8.7.0 to before 8.7.12; 8.8.0 to before 8.8.4 | Vulnerable | Drupal |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* | 9.3.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* | before 20.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* | before 9.2.5.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Oracle |
- cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions 4.0 to before 4.14 Vulnerable ·ckeditor
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.7.0 to before 8.7.12; 8.8.0 to before 8.8.4 Vulnerable ·Drupal
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 20.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.5.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Oracle
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* | 8.56 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_apps_-_customer_order_management:*:*:*:*:*:*:*:* | before 21.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* | 2.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:* | 2.3.0 – 2.4.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_apps_-_customer_order_management:*:*:*:*:*:*:*:* Versions before 21.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-vcjf-mgcg-jxjq ckeditor4 (npm) Fixed in 4.14.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9281
- 2026-10-03 Alias added: GHSA-vcjf-mgcg-jxjq
References
Patch 4
Advisory 6
Other 3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4
Sources
- CVE-2020-9281 · CVE Program
- CVE-2020-9281 · NVD
- FIRST EPSS
- GHSA-vcjf-mgcg-jxjq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-9281 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences