Read the docs
TI-2021-18004 Aliases CVE-2021-41165GHSA-7h26-63m7-qhf2

HTML comments vulnerability allowing to execute JavaScript code

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Why it matters now

EPSS 0.01573 75th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.17.0ckeditor4 (npm): 4.17.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.17.04.17.0Patch availableCNA
—ckeditor4 (npm)before 4.17.04.17.0Patch availableGHSA-7h26-63m7-qhf2
—ckeditor/ckeditor (Packagist)before 4.17.04.17.0Patch availableGHSA-7h26-63m7-qhf2
  • ckeditor4 Vendorckeditor Affected before 4.17.0 Fixed in 4.17.0 Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.17.0 Fixed in 4.17.0 Patch available GHSA-7h26-63m7-qhf2
  • ckeditor/ckeditor (Packagist) Vendor— Affected before 4.17.0 Fixed in 4.17.0 Patch available GHSA-7h26-63m7-qhf2

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*before 4.17.0Vulnerableckeditor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*8.9.0 to before 8.9.20; 9.1.0 to before 9.1.14; 9.2.0 to before 9.2.9VulnerableDrupal
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*before 22.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*18.1 – 18.3VulnerableOracle
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions before 4.17.0 Vulnerable ·ckeditor
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.9.0 to before 8.9.20; 9.1.0 to before 9.1.14; 9.2.0 to before 9.2.9 Vulnerable ·Drupal
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:* Versions 18.1 – 18.3 Vulnerable ·Oracle
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.17.0
  • Fix · GHSA-7h26-63m7-qhf2 ckeditor4 (npm) Fixed in 4.17.0 Advisory →
  • Fix · GHSA-7h26-63m7-qhf2 ckeditor/ckeditor (Packagist) Fixed in 4.17.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41165
  2. 2026-10-03 Alias added: GHSA-7h26-63m7-qhf2

References

Patch 2

Advisory 4

Other 2

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
  • TI-2021-15570 Execution of JavaScript code using malformed HTML in ckeditor CVSS 3.1HIGH 7.3
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences