CVE-2021-41164, GHSA-pvmx-g8h5-cprj
npm/ckeditor4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CKEditor4 is an open source WYSIWYG HTML editor. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code.
All versions starting from 4.0 before 4.17.0
Upgrade to version 4.17.0 or above.
2021-11-22
source |