CVE-2021-33829: Cross-site Scripting in ckeditor4
Summary
CVE-2021-33829: ckeditor4 vulnerable to cross-site scripting. Affects ckeditor4 versions >= 4.14.0, < 4.16.1. Fixed in 4.16.1. How to fix ↓
Also tracked for
The same CVE-2021-33829 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a widely used rich text editor that enables users to create and edit content in HTML format. It provides a user-friendly interface with various features for formatting and styling text. However, CKEditor 4 versions 4.14.0 through 4.16.x before 4.16.1 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows remote attackers to inject executable JavaScript code through a crafted comment, as the HTML Data Processor mishandles the --!> sequence.
Vulnerability Detail
The XSS vulnerability in CKEditor 4 can have serious consequences for affected applications. By exploiting this vulnerability, an attacker can inject malicious JavaScript code into the application, which will be executed in the context of the user's browser. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or redirecting the user to malicious websites. The vulnerability is rated as moderate severity with a CVSS score of 6.1.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.16.1
This is the first release that contains the fix.
npm install ckeditor4@4.16.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented to mitigate the risk. One possible workaround is to disable the use of comments in the CKEditor configuration. This can be achieved by modifying the CKEditor configuration file and removing or commenting out the 'comment' plugin. However, this workaround may affect the functionality of the editor, so upgrading to the fixed version is still recommended.
Conclusion
The XSS vulnerability in CKEditor 4 can have serious implications for applications using the affected versions. It is crucial to upgrade to the fixed version or apply the recommended workaround to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is a popular rich text editor used for creating and editing HTML content.
The vulnerability allows remote attackers to inject malicious JavaScript code into the application, potentially leading to various attacks such as data theft or unauthorized actions.
To fix this vulnerability, upgrade CKEditor 4 to version 4.16.1 or later. Alternatively, you can disable the 'comment' plugin in the CKEditor configuration.
Yes, a temporary workaround is to disable the 'comment' plugin in the CKEditor configuration. However, upgrading to the fixed version is still recommended.
The vulnerability is rated as moderate severity with a CVSS score of 6.1.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
