CVE-2021-37695: CKEditor 4 Fake Objects Plugin Malformed HTML Execution
Summary
CVE-2021-37695: Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML. Affects ckeditor4 versions < 4.16.2. Fixed in 4.16.2. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2021-37695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a popular open-source rich text editor used for web content creation. It provides various plugins to enhance functionality, including the Fake Objects plugin. The Fake Objects plugin allows users to insert and manipulate non-editable elements like images, links, flash objects, iframes, forms, and page breaks within the editor. This vulnerability affects CKEditor 4 and all plugins that depend on the Fake Objects plugin.
Vulnerability Detail
The CKEditor 4 Fake Objects plugin was found to have a vulnerability that allowed the injection of malformed HTML code, leading to the execution of arbitrary JavaScript code. This could be exploited by an attacker to perform cross-site scripting (XSS) attacks, potentially compromising user data and enabling unauthorized actions on the affected web application. The vulnerability affects CKEditor 4 versions prior to 4.16.2.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.16.2
This is the first release that contains the fix.
npm install ckeditor4@4.16.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to disable or remove the Fake Objects plugin and any dependent plugins from the CKEditor 4 configuration. This can be done by modifying the CKEditor configuration file or removing the corresponding plugin files from the server.
Conclusion
The CKEditor 4 Fake Objects plugin vulnerability allows for the execution of arbitrary JavaScript code through the injection of malformed HTML. To protect your web application, it is crucial to update CKEditor 4 and the affected plugins to version 4.16.2 or later. If immediate updating is not possible, consider disabling or removing the Fake Objects plugin and its dependent plugins. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is a widely used open-source rich text editor for web content creation. It provides a user-friendly interface and various plugins to enhance functionality.
The Fake Objects plugin is a CKEditor 4 plugin that allows users to insert and manipulate non-editable elements like images, links, flash objects, iframes, forms, and page breaks within the editor.
The vulnerability allows an attacker to inject malicious JavaScript code through the Fake Objects plugin, potentially leading to cross-site scripting (XSS) attacks. This can result in unauthorized access to user data and the execution of unauthorized actions on the affected web application.
The vulnerability affects CKEditor 4 versions prior to 4.16.2.
The vulnerability can be mitigated by updating CKEditor 4 and the affected plugins to version 4.16.2 or later. Alternatively, disabling or removing the Fake Objects plugin and its dependent plugins can serve as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
