CVE-2018-17960: ckeditor - User-Assisted XSS Vulnerability
Summary
CVE-2018-17960: Ckeditor XSS Vulnerability. Affects ckeditor versions < 4.11.0. Fixed in 4.11.0. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2018-17960 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor is a widely used rich text editor that enables users to create and edit content in web applications. It provides a range of features for formatting text, including the ability to paste content from various sources. However, versions of CKEditor prior to 4.11.0 are vulnerable to a user-assisted cross-site scripting (XSS) attack when pasting content in source mode.
Vulnerability Detail
The vulnerability (CVE-2018-17960) in CKEditor allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can occur when a user pastes specially crafted content in source mode, which is then rendered without proper sanitization. An attacker could exploit this vulnerability to perform various malicious actions, such as stealing sensitive information, manipulating the user interface, or performing actions on behalf of the user.
How To Fix
Latest published version: 4.12.1 as of 23 Oct 2026
npm install ckeditor@4.12.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.0
This is the first release that contains the fix.
npm install ckeditor@4.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading CKEditor is not immediately feasible, a temporary workaround is to disable the source mode paste functionality. This can be achieved by modifying the CKEditor configuration to remove or disable the paste-related plugins. Here's an example of how to disable the paste-related plugins in the CKEditor configuration:
CKEDITOR.replace('editor1', {
removePlugins: 'pastefromword,pastetext,paste',
disablePlugins: 'pastefromword,pastetext,paste'
});
Conclusion
The user-assisted XSS vulnerability in CKEditor (CVE-2018-17960) allows attackers to execute arbitrary JavaScript code in the user's browser. To mitigate this vulnerability, it is recommended to upgrade CKEditor to version 4.11.0 or later. If immediate upgrade is not possible, disabling the source mode paste functionality can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ckeditor →
FAQ
CKEditor is a popular rich text editor used in web applications to enable users to create and edit content with formatting options.
The vulnerability allows an attacker to execute arbitrary JavaScript code in the user's browser, potentially leading to unauthorized actions, data theft, or UI manipulation.
To fix this vulnerability, upgrade CKEditor to version 4.11.0 or later, which includes a fix for the user-assisted XSS vulnerability.
Yes, you can temporarily disable the source mode paste functionality by removing or disabling the paste-related plugins in the CKEditor configuration.
You can find more information about this vulnerability in the CVE-2018-17960 advisory and the CKEditor documentation.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor.
