Read the docs
TI-2024-29056 Aliases CVE-2024-43407GHSA-7r32-vfj5-c2jv

Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed ckeditor4 (ckeditor): 4.25.0-ltsckeditor4 (npm): 4.25.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor4before 4.25.0-lts4.25.0-ltsPatch availableCNA
—ckeditor4 (npm)before 4.25.04.25.0Patch availableGHSA-7r32-vfj5-c2jv
—ckeditor/ckeditor (Packagist)before 4.25.04.25.0Patch availableGHSA-7r32-vfj5-c2jv
  • ckeditor4 Vendorckeditor Affected before 4.25.0-lts Fixed in 4.25.0-lts Patch available CNA
  • ckeditor4 (npm) Vendor— Affected before 4.25.0 Fixed in 4.25.0 Patch available GHSA-7r32-vfj5-c2jv
  • ckeditor/ckeditor (Packagist) Vendor— Affected before 4.25.0 Fixed in 4.25.0 Patch available GHSA-7r32-vfj5-c2jv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:lts:*:*:*4.0 to before 4.25.0Vulnerableckeditor
  • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:lts:*:*:* Versions 4.0 to before 4.25.0 Vulnerable ·ckeditor

Remediation

  • Fix · CNA ckeditor4 (ckeditor) Fixed in 4.25.0-lts
  • Fix · GHSA-7r32-vfj5-c2jv ckeditor4 (npm) Fixed in 4.25.0 Advisory →
  • Fix · GHSA-7r32-vfj5-c2jv ckeditor/ckeditor (Packagist) Fixed in 4.25.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43407
  2. 2026-10-03 Alias added: GHSA-7r32-vfj5-c2jv

References

Patch 2

Advisory 2

Other 1

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
  • TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences