Read the docs
TI-2021-13179 Aliases CVE-2021-33829GHSA-rgx6-rjj4-c388

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4…

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Why it matters now

EPSS 0.03189 88th percentileScored 2026-11-07
Fix Fixed ckeditor4 (npm): 4.16.1drupal/core (Packagist): 7.80, 8.9.16, 9.0.14 +1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ckeditor4 (npm)4.14.0 to before 4.16.14.16.1Patch availableGHSA-rgx6-rjj4-c388
—drupal/core (Packagist)7.0.0 to before 7.807.80Patch availableGHSA-rgx6-rjj4-c388
—drupal/core (Packagist)8.0.0 to before 8.9.168.9.16Patch availableGHSA-rgx6-rjj4-c388
—drupal/core (Packagist)9.0.0 to before 9.0.149.0.14Patch availableGHSA-rgx6-rjj4-c388
—drupal/core (Packagist)9.1.0 to before 9.1.99.1.9Patch availableGHSA-rgx6-rjj4-c388
—drupal/drupal (Packagist)7.0.0 to before 7.807.80Patch availableGHSA-rgx6-rjj4-c388
—drupal/drupal (Packagist)8.0.0 to before 8.9.168.9.16Patch availableGHSA-rgx6-rjj4-c388
—drupal/drupal (Packagist)9.0.0 to before 9.0.149.0.14Patch availableGHSA-rgx6-rjj4-c388
—drupal/drupal (Packagist)9.1.0 to before 9.1.99.1.9Patch availableGHSA-rgx6-rjj4-c388
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ckeditor4 (npm) Vendor— Affected 4.14.0 to before 4.16.1 Fixed in 4.16.1 Patch available GHSA-rgx6-rjj4-c388
  • drupal/core (Packagist) Vendor— Affected 7.0.0 to before 7.80 Fixed in 7.80 Patch available GHSA-rgx6-rjj4-c388
  • drupal/core (Packagist) Vendor— Affected 8.0.0 to before 8.9.16 Fixed in 8.9.16 Patch available GHSA-rgx6-rjj4-c388
  • drupal/core (Packagist) Vendor— Affected 9.0.0 to before 9.0.14 Fixed in 9.0.14 Patch available GHSA-rgx6-rjj4-c388
  • drupal/core (Packagist) Vendor— Affected 9.1.0 to before 9.1.9 Fixed in 9.1.9 Patch available GHSA-rgx6-rjj4-c388
  • drupal/drupal (Packagist) Vendor— Affected 7.0.0 to before 7.80 Fixed in 7.80 Patch available GHSA-rgx6-rjj4-c388
  • drupal/drupal (Packagist) Vendor— Affected 8.0.0 to before 8.9.16 Fixed in 8.9.16 Patch available GHSA-rgx6-rjj4-c388
  • drupal/drupal (Packagist) Vendor— Affected 9.0.0 to before 9.0.14 Fixed in 9.0.14 Patch available GHSA-rgx6-rjj4-c388
  • drupal/drupal (Packagist) Vendor— Affected 9.1.0 to before 9.1.9 Fixed in 9.1.9 Patch available GHSA-rgx6-rjj4-c388

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*4.14.0 to before 4.16.1Vulnerableckeditor
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*8.9.0 to before 8.9.16; 9.0.0 to before 9.0.14; 9.1.0 to before 9.1.9VulnerableDrupal
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions 4.14.0 to before 4.16.1 Vulnerable ·ckeditor
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.9.0 to before 8.9.16; 9.0.0 to before 9.0.14; 9.1.0 to before 9.1.9 Vulnerable ·Drupal
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-rgx6-rjj4-c388 ckeditor4 (npm) Fixed in 4.16.1 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/core (Packagist) Fixed in 7.80 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/core (Packagist) Fixed in 8.9.16 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/core (Packagist) Fixed in 9.0.14 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/core (Packagist) Fixed in 9.1.9 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/drupal (Packagist) Fixed in 7.80 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/drupal (Packagist) Fixed in 8.9.16 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/drupal (Packagist) Fixed in 9.0.14 Advisory →
  • Fix · GHSA-rgx6-rjj4-c388 drupal/drupal (Packagist) Fixed in 9.1.9 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33829
  2. 2026-10-03 Alias added: GHSA-rgx6-rjj4-c388

References

Patch 2

Advisory 5

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences