# ckeditor4 (npm) vulnerabilities

16 known vulnerabilities (4 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/ckeditor4

## Advisories (16)

### [CVE-2024-43411](https://cve.now/CVE-2024-43411): CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover

- Severity: Low 3.1
- Published: Aug 21, 2024
- Affected: from 4.22.0, fixed in 4.25.0.

### [CVE-2024-43407](https://cve.now/CVE-2024-43407): Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

- Severity: Medium 6.1
- Published: Aug 21, 2024
- Affected: fixed in 4.25.0.

### [CVE-2024-24816](https://cve.now/CVE-2024-24816): Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

- Severity: Medium 6.1
- Published: Feb 7, 2024
- Affected: fixed in 4.24.0-lts.

### [CVE-2024-24815](https://cve.now/CVE-2024-24815): CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

- Severity: Medium 6.1
- Published: Feb 7, 2024
- Affected: fixed in 4.24.0-lts.

### [CVE-2023-4771](https://cve.now/CVE-2023-4771): Cross-Site Scripting vulnerability in CKSource CKEditor

- Severity: Medium 6.1
- Published: Nov 16, 2023
- Affected: fixed in 4.24.0-lts.

### [CVE-2022-24729](https://cve.now/CVE-2022-24729): Regular expression Denial of Service in dialog plugin

- Severity: Medium 6.5
- Published: Mar 16, 2022
- Affected: fixed in 4.18.0.

### [CVE-2022-24728](https://cve.now/CVE-2022-24728): Cross-site Scripting in CKEditor4

- Severity: Medium 5.4
- Published: Mar 16, 2022
- Affected: fixed in 4.18.0.

### [CVE-2021-41165](https://cve.now/CVE-2021-41165): HTML comments vulnerability allowing to execute JavaScript code

- Severity: High 8.2
- Published: Nov 17, 2021
- Affected: fixed in 4.17.0.

### [CVE-2021-41164](https://cve.now/CVE-2021-41164): Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML

- Severity: High 8.2
- Published: Nov 17, 2021
- Affected: fixed in 4.17.0.

### [CVE-2021-37695](https://cve.now/CVE-2021-37695): Execution of JavaScript code using malformed HTML in ckeditor

- Severity: High 7.3
- Published: Aug 12, 2021
- Affected: fixed in 4.16.2.

### [CVE-2021-32809](https://cve.now/CVE-2021-32809): Arbitrary HTML injection vulnerability in ckeditor

- Severity: Medium 4.6
- Published: Aug 12, 2021
- Affected: from 4.5.2, fixed in 4.16.2.

### [CVE-2021-32808](https://cve.now/CVE-2021-32808): Cross-site scripting in ckeditor via abuse of undo functionality

- Severity: High 7.6
- Published: Aug 12, 2021
- Affected: from 4.13.0, fixed in 4.16.2.

### [CVE-2021-33829](https://cve.now/CVE-2021-33829): A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote…

- Severity: Unrated
- Published: Jun 9, 2021
- Affected: from 4.14.0, fixed in 4.16.1.

### [CVE-2021-26272](https://cve.now/CVE-2021-26272): It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into…

- Severity: Unrated
- Published: Jan 26, 2021
- Affected: fixed in 4.16.0.

### [CVE-2020-27193](https://cve.now/CVE-2020-27193): A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web…

- Severity: Unrated
- Published: Nov 12, 2020
- Affected: fixed in 4.15.1.

### [CVE-2020-9281](https://cve.now/CVE-2020-9281): A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject…

- Severity: Unrated
- Published: Mar 7, 2020
- Affected: fixed in 4.14.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/ckeditor4
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.