Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ckeditor | 4.12.1+dfsg-1ubuntu0.1 | USN-5340-1 |
| Ubuntu 18.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.18.04.1 | USN-5340-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | USN-5340-2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ckeditor4 | < 4.14.0 | 4.14.0 | GHSA-vcjf-mgcg-jxjq |
Advisories 2
- USN-5340-2 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5340-1 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- FEDORA-2020-8d5de93970 vendor-advisory
- FEDORA-2020-261449d821 vendor-advisory
- FEDORA-2020-a832c215bf vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/ckeditor/ckeditor4
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html