CVE-2021-41165, GHSA-7h26-63m7-qhf2
npm/ckeditor4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CKEditor4 is an open source WYSIWYG HTML editor. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at The problem has been recognized and patched.
All versions before 4.17.0
Upgrade to version 4.17.0 or above.
2021-11-24
source |