Read the docs
TI-2021-18003 Aliases CVE-2021-41164GHSA-pvmx-g8h5-cprj

Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Why it matters now

EPSS 0.01346 71st percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.17.0ckeditor4 (npm): 4.17.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.17.04.17.0Patch availableCNA
—ckeditor4 (npm)before 4.17.04.17.0Patch availableGHSA-pvmx-g8h5-cprj
  • ckeditor4 Vendorckeditor Affected before 4.17.0 Fixed in 4.17.0 Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.17.0 Fixed in 4.17.0 Patch available GHSA-pvmx-g8h5-cprj

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*4.0 to before 4.17.0Vulnerableckeditor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*8.9.0 to before 8.9.20; 9.1.0 to before 9.1.14; 9.2.0 to before 9.2.9VulnerableDrupal
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions 4.0 to before 4.17.0 Vulnerable ·ckeditor
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.9.0 to before 8.9.20; 9.1.0 to before 9.1.14; 9.2.0 to before 9.2.9 Vulnerable ·Drupal
  • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*before 22.1VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.17.0
  • Fix · GHSA-pvmx-g8h5-cprj ckeditor4 (npm) Fixed in 4.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41164
  2. 2026-10-03 Alias added: GHSA-pvmx-g8h5-cprj

References

Patch 3

Advisory 5

Other 4

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
  • TI-2021-15570 Execution of JavaScript code using malformed HTML in ckeditor CVSS 3.1HIGH 7.3
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences