Skip to content
OpenAdvisories
High USN-5340-2 5 CVEs

ckeditor vulnerabilities

Published Mar 23, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-5340-1 fixed several vulnerabilities in CKEditor.
This update provides the fixes for CVE-2018-9861, CVE-2020-9281,
CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.

Original advisory details:

Kyaw Min Thein discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue
to execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS. (CVE-2018-9861)

Micha Bentkowski discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)

Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. This issue only affects
Ubuntu 21.10. (CVE-2021-32808)

Anton Subbotin discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
inject arbitrary code. (CVE-2021-32809)

Or Sahar discovered that CKEditor incorrectly handled certain
inputs. An attacker could possibly use this issue to execute
arbitrary code. This issue only affects
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)

Mika Kulmala discovered that CKEditor incorrectly handled
certain inputs. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2021-37695)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ckeditor 4.5.7+dfsg-2ubuntu0.16.04.1~esm1

Vulnerabilities 5

  • High 7.3
    CVE-2021-37695

    Execution of JavaScript code using malformed HTML in ckeditor

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objec…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  • Medium 6.1
    CVE-2018-9861

    Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject a…

    drupal/core drupal/drupal ckeditor ckeditor-dev Ubuntu npm Packagist
  • Medium 6.1
    CVE-2020-9281

    CKEditor 4.0 vulnerability in the HTML Data Processor

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

    ckeditor ckeditor4 Ubuntu npm
  • Medium 6.1
    CVE-2021-33829 Scanner template

    ckeditor4 vulnerable to cross-site scripting

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

    drupal/core drupal/drupal ckeditor ckeditor Debian Ubuntu npm Packagist
  • Medium 4.6
    CVE-2021-32809

    Arbitrary HTML injection vulnerability in ckeditor

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using …

    ckeditor ckeditor4 ckeditor ckeditor Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2018-9861
  • report
    https://ubuntu.com/security/CVE-2020-9281
  • report
    https://ubuntu.com/security/CVE-2021-32809
  • report
    https://ubuntu.com/security/CVE-2021-33829
  • report
    https://ubuntu.com/security/CVE-2021-37695