Read the docs
TI-2021-04357 Aliases CVE-2021-21254GHSA-hgmg-hhc8-g5wr

Regular expression Denial of Service in Markdown plugin

Priority LOW 32CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.

Why it matters now

EPSS 0.01814 78th percentileScored 2026-11-07
Fix Fixed ckeditor5 (ckeditor): 25.0.0@ckeditor/ckeditor5-markdown-gfm (npm): 25.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor5before 25.0.025.0.0Patch availableCNA
—@ckeditor/ckeditor5-markdown-gfm (npm)before 25.0.025.0.0Patch availableGHSA-hgmg-hhc8-g5wr
  • ckeditor5 Vendorckeditor Affected before 25.0.0 Fixed in 25.0.0 Patch available CNA
  • @ckeditor/ckeditor5-markdown-gfm (npm) Vendor— Affected before 25.0.0 Fixed in 25.0.0 Patch available GHSA-hgmg-hhc8-g5wr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*before 25.0.0Vulnerableckeditor
  • cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:* Versions before 25.0.0 Vulnerable ·ckeditor

Remediation

  • Fix · CNA ckeditor5 (ckeditor) Fixed in 25.0.0
  • Fix · GHSA-hgmg-hhc8-g5wr @ckeditor/ckeditor5-markdown-gfm (npm) Fixed in 25.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21254
  2. 2026-10-03 Alias added: GHSA-hgmg-hhc8-g5wr

References

Advisory 3

Other 3

  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2026-22628 CKEditor: Cross-site scripting (XSS) in the HTML Support package CVSS 3.1MEDIUM 6.4
  • TI-2024-30632 CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences