Read the docs
TI-2021-12473 Aliases CVE-2021-32808GHSA-6226-h7ff-ch6c

Cross-site scripting in ckeditor via abuse of undo functionality

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Why it matters now

EPSS 0.01192 68th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.16.2ckeditor4 (npm): 4.16.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor44.13.0 to before 4.16.24.16.2Patch availableCNA
—ckeditor4 (npm)4.13.0 to before 4.16.24.16.2Patch availableGHSA-6226-h7ff-ch6c
  • ckeditor4 Vendorckeditor Affected 4.13.0 to before 4.16.2 Fixed in 4.16.2 Patch available CNA
  • ckeditor4 (npm) Vendor— Affected 4.13.0 to before 4.16.2 Fixed in 4.16.2 Patch available GHSA-6226-h7ff-ch6c

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:node.js:*:*4.13.0 to before 4.16.2Vulnerableckeditor
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*before 21.1.4VulnerableOracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:*12.6.3VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:*12.6.4VulnerableOracle
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:node.js:*:* Versions 4.13.0 to before 4.16.2 Vulnerable ·ckeditor
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 21.1.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:* Versions 12.6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:* Versions 12.6.4 Vulnerable ·Oracle
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.7 – 8.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.0.8.0.0:*:*:*:*:*:*:*8.0.8.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.0.0.0:*:*:*:*:*:*:*8.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*up to 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 21.9VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.7 – 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.0.8.0.0:*:*:*:*:*:*:* Versions 8.0.8.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.0.0.0:*:*:*:*:*:*:* Versions 8.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions up to 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 21.9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.16.2
  • Fix · GHSA-6226-h7ff-ch6c ckeditor4 (npm) Fixed in 4.16.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32808
  2. 2026-10-03 Alias added: GHSA-6226-h7ff-ch6c

References

Patch 2

Advisory 6

Other 4

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
  • TI-2021-15570 Execution of JavaScript code using malformed HTML in ckeditor CVSS 3.1HIGH 7.3
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences