Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | ckeditor | 4.16.0+dfsg-2 | — |
| Debian 12 | ckeditor3 | No fix yet | — |
| Debian 9 | ckeditor | 4.5.7+dfsg-2+deb9u1 | DLA-2813-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ckeditor | 4.12.1+dfsg-1ubuntu0.1 | USN-5340-1 |
| Ubuntu 18.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.18.04.1 | USN-5340-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 | USN-5340-2 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Drupal 7 CKEditor XSS http/cves/2021/CVE-2021-33829.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ckeditor4 | >= 4.14.0, < 4.16.1 | 4.16.1 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/core | >= 8.0.0, < 8.9.16 · >= 9.0.0, < 9.0.14 · >= 9.1.0, < 9.1.9 | 8.9.16, 9.0.14, 9.1.9 | DRUPAL-CORE-2021-003 |
| Packagist | drupal/core | >= 7.0.0, < 7.80 | 7.80 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/core | >= 8.0.0, < 8.9.16 | 8.9.16 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/core | >= 9.0.0, < 9.0.14 | 9.0.14 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/core | >= 9.1.0, < 9.1.9 | 9.1.9 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/drupal | >= 7.0.0, < 7.80 | 7.80 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/drupal | >= 8.0.0, < 8.9.16 | 8.9.16 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/drupal | >= 9.0.0, < 9.0.14 | 9.0.14 | GHSA-rgx6-rjj4-c388 |
| Packagist | drupal/drupal | >= 9.1.0, < 9.1.9 | 9.1.9 | GHSA-rgx6-rjj4-c388 |
Advisories 4
- USN-5340-2 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5340-1 ckeditor vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2813-1 ckeditor - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2024-0234 OTRS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 28, 2024
References
- https://www.drupal.org/sa-core-2021-003
- https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
- FEDORA-2021-51457da891 vendor-advisory
- FEDORA-2021-72176a63a8 vendor-advisory
- FEDORA-2021-87578dca12 vendor-advisory
- [debian-lts-announce] 20211109 [SECURITY] [DLA 2813-1] ckeditor security update mailing-list