CVE-2021-41165

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in npm/ckeditor4

Identifiers

CVE-2021-41165, GHSA-7h26-63m7-qhf2

Package Slug

npm/ckeditor4

Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

CKEditor4 is an open source WYSIWYG HTML editor. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at The problem has been recognized and patched.

Affected Versions

All versions before 4.17.0

Solution

Upgrade to version 4.17.0 or above.

Last Modified

2021-11-24

source