Read the docs
TI-2021-15570 Aliases CVE-2021-37695GHSA-m94c-37g6-cjhc

Execution of JavaScript code using malformed HTML in ckeditor

Priority LOW 35CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Why it matters now

EPSS 0.01318 70th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.16.2ckeditor4 (npm): 4.16.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.16.24.16.2Patch availableCNA
—ckeditor4 (npm)before 4.16.24.16.2Patch availableGHSA-m94c-37g6-cjhc
  • ckeditor4 Vendorckeditor Affected before 4.16.2 Fixed in 4.16.2 Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.16.2 Fixed in 4.16.2 Patch available GHSA-m94c-37g6-cjhc

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*before 4.16.2Vulnerableckeditor
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*before 21.1.4VulnerableOracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:*12.6.3VulnerableOracle
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions before 4.16.2 Vulnerable ·ckeditor
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 21.1.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_merchandising:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:documaker:12.6.3:*:*:*:*:*:*:* Versions 12.6.3 Vulnerable ·Oracle
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:*12.6.4VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.7 – 8.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:*8.0.3VulnerableOracle
cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:*8.0.8.0.0 – 8.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*before 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
  • cpe:2.3:a:oracle:documaker:12.6.4:*:*:*:*:*:*:* Versions 12.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.7 – 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:* Versions 8.0.8.0.0 – 8.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.16.2
  • Fix · GHSA-m94c-37g6-cjhc ckeditor4 (npm) Fixed in 4.16.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37695
  2. 2026-10-03 Alias added: GHSA-m94c-37g6-cjhc

References

Patch 3

Advisory 6

Other 4

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences