CVE-2021-26272: Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Summary
CVE-2021-26272: Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4. Affects ckeditor4 versions < 4.16.0. Fixed in 4.16.0. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2021-26272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a popular open-source rich text editor used for web content creation. It provides a wide range of features and plugins to enhance the editing experience. However, CKEditor 4 versions prior to 4.16 were vulnerable to an issue that allowed for the execution of a ReDoS-type attack. This vulnerability could be exploited by convincing a user to paste crafted URL-like text into the editor and then pressing Enter or Space in the Autolink plugin.
Vulnerability Detail
The vulnerability in CKEditor 4 before version 4.16 allowed for the execution of a ReDoS-type attack. By manipulating the Autolink plugin, an attacker could craft malicious URL-like text that triggers excessive backtracking in the parsing process. This could lead to a denial-of-service (DoS) scenario, where the editor becomes unresponsive or crashes. The impact of this vulnerability is considered moderate.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.16.0
This is the first release that contains the fix.
npm install ckeditor4@4.16.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding pasting untrusted or crafted URL-like text into CKEditor 4 versions prior to 4.16.
Conclusion
In conclusion, CKEditor 4 versions prior to 4.16 were vulnerable to a ReDoS-type attack. This vulnerability could be exploited by manipulating the Autolink plugin and pasting crafted URL-like text. Upgrading to CKEditor 4 version 4.16.0 or later is recommended to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is an open-source rich text editor used for web content creation. It provides a user-friendly interface and a wide range of features to enhance the editing experience.
A ReDoS (Regular Expression Denial of Service) attack is a type of vulnerability where an attacker can manipulate a regular expression pattern to cause excessive backtracking, leading to a denial-of-service scenario.
An attacker can exploit this vulnerability by convincing a user to paste crafted URL-like text into CKEditor 4 and then pressing Enter or Space in the Autolink plugin. This triggers excessive backtracking in the parsing process, leading to a denial-of-service scenario.
The impact of this vulnerability is considered moderate. It can lead to a denial-of-service scenario where the CKEditor 4 becomes unresponsive or crashes.
To mitigate the risk, it is recommended to upgrade CKEditor 4 to version 4.16.0 or later. Additionally, users should avoid pasting untrusted or crafted URL-like text into CKEditor 4 versions prior to 4.16.
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
