CVE-2024-43411: CKEditor4 low-risk XSS vulnerability linked to potential domain takeover
Summary
CVE-2024-43411: CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover. Affects ckeditor4 versions >= 4.22.0, < 4.25.0. Fixed in 4.25.0. How to fix ↓
Also tracked for
- ckeditor · Debian:13
The same CVE-2024-43411 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor4 is a widely used open-source rich text editor that provides a range of features for creating and editing content. It is commonly integrated into web applications to enable users to input and format text. The vulnerability in question affects CKEditor4 instances with enabled version notifications. However, this feature is disabled by default in all CKEditor 4 LTS versions, making it highly unlikely that most users are affected. CKEditor 4.22 and above are vulnerable to a low-risk cross-site scripting (XSS) vulnerability that is linked to a potential domain takeover of the 'cke4.ckeditor.com' domain.
Vulnerability Detail
The theoretical vulnerability arises from the scenario where an attacker gains control over the 'cke4.ckeditor.com' domain. In this unlikely event, the attacker could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, CKEditor has addressed it in version 4.25.0-lts to ensure compliance with security best practices. The impact of this vulnerability is considered low, but it is still important to apply the patch to mitigate any potential risks.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.25.0
This is the first release that contains the fix.
npm install ckeditor4@4.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
CKEditor 4.22 and above are vulnerable to a low-risk XSS vulnerability that is linked to a potential domain takeover. However, the impact of this vulnerability is considered low, and it is unlikely to affect users of CKEditor 4 LTS versions. CKEditor has addressed the vulnerability in version 4.25.0-lts, and users are advised to update to this version or later to ensure compliance with security best practices.
See every vulnerability recorded for ckeditor4 →
FAQ
No, the vulnerability only affects CKEditor 4 instances with enabled version notifications, which are disabled by default in all CKEditor 4 LTS versions. If you are using CKEditor 4 LTS, it is highly unlikely that you are affected.
The potential impact is low, as the vulnerability is purely hypothetical. However, if an attacker gains control over the 'cke4.ckeditor.com' domain, they could potentially execute an attack on CKEditor 4 instances.
Yes, CKEditor has addressed this vulnerability in version 4.25.0-lts. It is recommended to update to this version or later to ensure compliance with security best practices.
To update CKEditor, you can follow the upgrade instructions provided by CKSource, the maintainers of CKEditor. These instructions will guide you through the process of updating your CKEditor integration to the latest version.
While the vulnerability is considered low-risk and purely hypothetical, it is still important to apply the patch to mitigate any potential risks. Keeping your software up to date with the latest security patches is a good practice to ensure the overall security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
