Description
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ckeditor | 4.12.1+dfsg-1ubuntu0.1 | USN-5340-1 |
| Ubuntu 18.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.18.04.1 | USN-5340-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | USN-5340-2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ckeditor-dev | >= 4.5.10, < 4.9.2 | 4.9.2 | GHSA-g78h-pf65-46rv |
| Packagist | drupal/core | >= 8.0.0, < 8.4.7 · >= 8.5.0, < 8.5.2 | 8.4.7, 8.5.2 | DRUPAL-CORE-2018-003 |
| Packagist | drupal/core | >= 8.5.0, < 8.5.2 | 8.5.2 | GHSA-g78h-pf65-46rv |
| Packagist | drupal/core | >= 8.0, < 8.4.7 | 8.4.7 | GHSA-g78h-pf65-46rv |
| Packagist | drupal/drupal | >= 8.0, < 8.4.7 | 8.4.7 | GHSA-g78h-pf65-46rv |
| Packagist | drupal/drupal | >= 8.5, < 8.5.2 | 8.5.2 | GHSA-g78h-pf65-46rv |
Advisories 2
- USN-5340-2 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5340-1 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026