TI-2024-29060 Aliases CVE-2024-43411 GHSA-6v96-m24v-f58j

CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover

LOW 16CWE-79Published 2024-08-21 · Updated 2024-08-22

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00427 37th percentileScored 2026-11-07

Fix Fixed ckeditor4 (ckeditor): 4.25.0-ltsckeditor4 (npm): 4.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ckeditor	ckeditor4	4.22.0 to before 4.25.0-lts	4.25.0-lts	Patch available	CNA
—	ckeditor4 (npm)	4.22.0 to before 4.25.0	4.25.0	Patch available	GHSA-6v96-m24v-f58j

ckeditor4 Vendorckeditor Affected 4.22.0 to before 4.25.0-lts Fixed in 4.25.0-lts Patch available CNA
ckeditor4 (npm) Vendor— Affected 4.22.0 to before 4.25.0 Fixed in 4.25.0 Patch available GHSA-6v96-m24v-f58j

Remediation

Fix · CNA ckeditor4 (ckeditor) Fixed in 4.25.0-lts
Fix · GHSA-6v96-m24v-f58j ckeditor4 (npm) Fixed in 4.25.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-43411
2026-10-03 Alias added: GHSA-6v96-m24v-f58j

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-43411

Other 3

TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
TI-2026-81521 Cross-site scripting in CKEditor 5 engine package CVSS 3.1HIGH 8.1
TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences