CVE-2021-41164 json
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
published 2021-11-17 4 y ago modified 2026-09-10 1 mo ago also BIT-drupal-2021-41164 , EUVD-2021-2375 , GHSA-pvmx-g8h5-cprj
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
Patch / fix
- npm ckeditor4 4.17.0
- bitnami drupal 8.9.20, 9.1.14, 9.2.9
- ckeditor ckeditor 4.17.0
- drupal drupal 8.9.20, 9.1.14, 9.2.9
- oracle application_express 22.1
- ckeditor Debian 12 4.19.0+dfsg-1
debian advisories DEBIAN-CVE-2021-41164
- drupal Arch Linux 9.2.9-1
arch linux advisories AVG-2565
Exploit prediction
1.35% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| OSV | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ckeditor4 | <4.17.0 |
4.17.0 |
| bitnami | drupal | >=8.9.0, <8.9.20 >=9.1.0, <9.1.14 >=9.2.0, <9.2.9 |
8.9.20 9.1.14 9.2.9 |
Affected products
- ckeditor ckeditor4
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
vendor-advisory, web
-
github.com
/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
web, third-party-advisory, advisory
-
drupal.org
/sa-core-2021-011
web, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujul2022.html
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2021-41164
advisory, web
-
github.com
/ckeditor/ckeditor4
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP
web
Sources
- CVE List CVE-2021-41164
- GitHub Advisory GHSA-pvmx-g8h5-cprj
- NVD CVE-2021-41164
- OSV BIT-drupal-2021-41164
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.