CVE-2021-32808: CKEditor 4 Widget Feature Vulnerability
Summary
CVE-2021-32808: Widget feature vulnerability allowing to execute JavaScript code using undo functionality. Affects ckeditor4 versions >= 4.13.0, < 4.16.2. Fixed in 4.16.2. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2021-32808 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a popular open-source rich text editor used for web content creation. It provides a wide range of features and plugins to enhance the editing experience. One of these plugins is the Widget plugin, which allows users to insert and manage interactive widgets in their content. Another plugin is the Undo feature, which provides the ability to undo and redo changes made in the editor. However, a vulnerability has been discovered in the Widget plugin when used alongside the Undo feature.
Vulnerability Detail
The vulnerability in CKEditor 4 Widget plugin allows an attacker to execute arbitrary JavaScript code by exploiting the undo functionality. By crafting a malformed widget HTML, an attacker can trigger the execution of JavaScript code when the undo action is performed. This can lead to various consequences, including unauthorized access to user data, session hijacking, or the injection of malicious content. The vulnerability affects all users of CKEditor 4 using the Widget and Undo plugins at version 4.13.0 or higher.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.16.2
This is the first release that contains the fix.
npm install ckeditor4@4.16.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch by upgrading to CKEditor 4 version 4.16.2 or later.
Conclusion
The vulnerability in CKEditor 4 Widget plugin can be exploited to execute arbitrary JavaScript code using the undo functionality. Users are advised to upgrade to CKEditor 4 version 4.16.2 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is an open-source rich text editor used for web content creation. It provides a user-friendly interface and a wide range of features to enhance the editing experience.
The Widget plugin in CKEditor 4 allows users to insert and manage interactive widgets in their content. It provides a way to create custom elements with dynamic behavior.
The Undo feature in CKEditor 4 provides the ability to undo and redo changes made in the editor. It allows users to revert back to previous states of the content.
The vulnerability in the Widget plugin allows an attacker to execute JavaScript code by exploiting the undo functionality. This can lead to unauthorized access, session hijacking, or the injection of malicious content.
To protect your CKEditor 4 installation, it is recommended to upgrade to version 4.16.2 or later, which contains the necessary patches to address the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
