CVE-2021-41165 json
HTML comments vulnerability allowing to execute JavaScript code
published 2021-11-17 4 y ago modified 2026-09-10 59 d ago also BIT-drupal-2021-41165 , EUVD-2021-2315 , GHSA-7h26-63m7-qhf2
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
Patch / fix
- npm ckeditor4 4.17.0
- packagist ckeditor/ckeditor 4.17.0
- bitnami drupal 8.9.20, 9.1.14, 9.2.9
- ckeditor ckeditor 4.17.0
- drupal drupal 8.9.20, 9.1.14, 9.2.9
- oracle application_express 22.1
- ckeditor Debian 12 4.19.0+dfsg-1
debian advisories DEBIAN-CVE-2021-41165
- drupal Arch Linux 9.2.9-1
arch linux advisories AVG-2565
Exploit prediction
1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| OSV | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | ckeditor4 | <4.17.0 |
4.17.0 |
| packagist | ckeditor/ckeditor | <4.17.0 |
4.17.0 |
| bitnami | drupal | >=8.9.0, <8.9.20 >=9.1.0, <9.1.14 >=9.2.0, <9.2.9 |
8.9.20 9.1.14 9.2.9 |
Affected products
- ckeditor ckeditor4
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
oracle.com
/security-alerts/cpujan2022.html
web, patch, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpuapr2022.html
web, patch, third-party-advisory, advisory
-
github.com
/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417
web, third-party-advisory, advisory
-
github.com
/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2
web, third-party-advisory, advisory
-
drupal.org
/sa-core-2021-011
web, third-party-advisory, advisory
-
oracle.com
/security-alerts/cpujul2022.html
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2021-41165
advisory, web
-
github.com
/ckeditor/ckeditor4
package
Sources
- CVE List CVE-2021-41165
- GitHub Advisory GHSA-7h26-63m7-qhf2
- NVD CVE-2021-41165
- OSV BIT-drupal-2021-41165
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.