Skip to content
OpenAdvisories
High DLA-2813-1 2 CVEs

ckeditor - security update

Published Nov 9, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 ckeditor 4.5.7+dfsg-2+deb9u1

Vulnerabilities 2

  • High 7.3
    CVE-2021-37695

    Execution of JavaScript code using malformed HTML in ckeditor

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objec…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  • Medium 6.1
    CVE-2021-33829 Scanner template

    ckeditor4 vulnerable to cross-site scripting

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

    drupal/core drupal/drupal ckeditor ckeditor Debian Ubuntu npm Packagist