CVE-2021-41164: Advanced Content Filter (ACF) vulnerability in CKEditor 4
Summary
CVE-2021-41164: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML. Affects ckeditor4 versions < 4.17.0. Fixed in 4.17.0. How to fix ↓
Also tracked for
The same CVE-2021-41164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a widely used rich text editor that provides a user-friendly interface for creating and editing content. It includes various plugins, one of which is the Advanced Content Filter (ACF) module. ACF is responsible for sanitizing and filtering the HTML content entered by users to prevent malicious code execution. However, a vulnerability has been discovered in the ACF module that allows an attacker to inject malformed HTML, bypassing the content sanitization process. This could potentially lead to the execution of JavaScript code.
Vulnerability Detail
The vulnerability in CKEditor 4's ACF module allows an attacker to bypass content sanitization and inject malformed HTML, which can result in the execution of JavaScript code. This can have serious consequences, such as unauthorized access to user data, session hijacking, or the delivery of malicious payloads. The vulnerability affects all users of CKEditor 4 versions prior to 4.17.0.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.0
This is the first release that contains the fix.
npm install ckeditor4@4.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Advanced Content Filter (ACF) vulnerability in CKEditor 4 allows for the execution of JavaScript code through the injection of malformed HTML. To mitigate this vulnerability, users should upgrade to CKEditor 4 version 4.17.0 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is a rich text editor used for creating and editing content. It provides a user-friendly interface and is widely used in web applications.
The Advanced Content Filter (ACF) module is a plugin in CKEditor 4 that sanitizes and filters HTML content to prevent malicious code execution.
The vulnerability allows an attacker to inject malformed HTML that bypasses the content sanitization process. This can lead to the execution of JavaScript code, potentially compromising the security of the application.
The vulnerability was discovered by Maurice Dauer (laytonctf) and reported to the CKEditor 4 team.
To protect your application, it is recommended to upgrade to CKEditor 4 version 4.17.0 or later, which includes the fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
