CVE-2021-21391: Uncontrolled Resource Consumption

April 29, 2021 (updated November 7, 2023)

CKEditor 5 provides a WYSIWYG editing solution. A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze.

References

nvd.nist.gov/vuln/detail/CVE-2021-21391

Detect and mitigate CVE-2021-21391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →