CVE-2021-21391: Regular expression Denial of Service in CKEditor 5 packages
Summary
CVE-2021-21391: Regular expression Denial of Service in multiple packages. Affects @ckeditor/ckeditor5-engine versions < 27.0.0. Fixed in 27.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 5 is a powerful and widely used rich text editor framework that provides a range of features for creating and editing content. It is commonly used in web applications to enable users to format and style text. The CKEditor 5 packages affected by this vulnerability include @ckeditor/ckeditor5-engine, @ckeditor/ckeditor5-font, @ckeditor/ckeditor5-image, @ckeditor/ckeditor5-list, @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-media-embed, @ckeditor/ckeditor5-paste-from-office, and @ckeditor/ckeditor5-widget. These packages are widely used in various npm ecosystems. The vulnerability allows an attacker to abuse certain regular expressions, leading to a denial of service (DoS) condition. This can cause a significant performance drop and freeze the browser tab.
Vulnerability Detail
The vulnerability arises from a regular expression denial of service (ReDoS) issue in multiple CKEditor 5 packages. By exploiting specific regular expressions, an attacker can trigger a significant performance degradation, resulting in a browser tab freeze. This can have a severe impact on the user experience and the availability of the affected application. The vulnerability affects all users of the CKEditor 5 packages mentioned above at versions up to and including 26.0.0. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2021-21391. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
27.0.0
This is the first release that contains the fix.
npm install @ckeditor/ckeditor5-engine@27.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The regular expression denial of service vulnerability in CKEditor 5 packages can have a significant impact on the performance and availability of web applications using these packages. It is crucial to update the affected packages to version 27.0.0 or later to mitigate the vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @ckeditor/ckeditor5-engine →
FAQ
CKEditor 5 is a popular rich text editor framework used for creating and editing content in web applications. It provides a range of features for formatting and styling text.
A regular expression denial of service (ReDoS) vulnerability occurs when a malicious input can cause a regular expression to take an excessive amount of time to evaluate. This can lead to a denial of service condition, impacting the performance and availability of the affected system.
The vulnerability allows an attacker to abuse specific regular expressions in CKEditor 5 packages, leading to a significant performance drop and freezing of the browser tab. This can severely impact the user experience and the availability of the affected application.
The vulnerability affects the following CKEditor 5 packages: @ckeditor/ckeditor5-engine, @ckeditor/ckeditor5-font, @ckeditor/ckeditor5-image, @ckeditor/ckeditor5-list, @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-media-embed, @ckeditor/ckeditor5-paste-from-office, and @ckeditor/ckeditor5-widget.
To fix the vulnerability, it is recommended to update the affected CKEditor 5 packages to version 27.0.0 or later. This can be done by updating the package version in the application's package.json file and running the package manager's update command.
