Read the docs
TI-2024-16333 Aliases CVE-2024-24816GHSA-mw2c-vx6j-mg76

Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01652 76th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.24.0-ltsckeditor4 (npm): 4.24.0-lts

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.24.0-lts4.24.0-ltsPatch availableCNA
—ckeditor4 (npm)before 4.24.0-lts4.24.0-ltsPatch availableGHSA-mw2c-vx6j-mg76
  • ckeditor4 Vendorckeditor Affected before 4.24.0-lts Fixed in 4.24.0-lts Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.24.0-lts Fixed in 4.24.0-lts Patch available GHSA-mw2c-vx6j-mg76

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*4.0 to before 4.24.0Vulnerableckeditor
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions 4.0 to before 4.24.0 Vulnerable ·ckeditor

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.24.0-lts
  • Fix · GHSA-mw2c-vx6j-mg76 ckeditor4 (npm) Fixed in 4.24.0-lts Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24816
  2. 2026-10-03 Alias added: GHSA-mw2c-vx6j-mg76

References

Patch 1

Advisory 2

Other 2

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences