CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ckeditor | ckeditor4 | before 4.24.0-lts | 4.24.0-lts | Patch available | CNA |
| — | ckeditor4 (npm) | before 4.24.0-lts | 4.24.0-lts | Patch available | GHSA-fq6h-4g8v-qqvm |
| — | ckeditor/ckeditor (Packagist) | before 4.24.0 | 4.24.0 | Patch available | GHSA-fq6h-4g8v-qqvm |
- ckeditor4 Vendorckeditor Affected before 4.24.0-lts Fixed in 4.24.0-lts Patch available CNA
- ckeditor4 (npm) Vendor— Affected before 4.24.0-lts Fixed in 4.24.0-lts Patch available GHSA-fq6h-4g8v-qqvm
- ckeditor/ckeditor (Packagist) Vendor— Affected before 4.24.0 Fixed in 4.24.0 Patch available GHSA-fq6h-4g8v-qqvm
Remediation
- Fix · CNA ckeditor4 (ckeditor) Fixed in 4.24.0-lts
- Fix · GHSA-fq6h-4g8v-qqvm ckeditor4 (npm) Fixed in 4.24.0-lts Advisory →
- Fix · GHSA-fq6h-4g8v-qqvm ckeditor/ckeditor (Packagist) Fixed in 4.24.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24815
- 2026-10-03 Alias added: GHSA-fq6h-4g8v-qqvm
References
Advisory 2
Other 5
- https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata
- https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html
- https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html
- https://www.drupal.org/sa-contrib-2024-009
- https://github.com/ckeditor/ckeditor4
More Ckeditor vulnerabilities
- TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
- TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
- TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
- TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
- TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
- TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24815 · CVE Program
- CVE-2024-24815 · NVD
- FIRST EPSS
- GHSA-fq6h-4g8v-qqvm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-24815 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences