CVE-2024-24815: CKEditor4 Cross-site Scripting Vulnerability
Summary
CVE-2024-24815: CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection. Affects ckeditor4 versions < 4.24.0-lts. Fixed in 4.24.0-lts. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2024-24815 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a widely used HTML text editor that allows users to create and edit rich content in web applications. It provides a range of features, including full-page editing mode and advanced content filtering. However, a vulnerability has been discovered in the core HTML parsing module of CKEditor 4, which affects versions prior to 4.24.0-lts. This vulnerability allows an attacker to inject malicious HTML content, bypassing the Advanced Content Filtering mechanism and potentially executing JavaScript code.
Vulnerability Detail
The CKEditor 4 vulnerability arises from incorrect CDATA detection in the HTML parsing module. When full-page editing mode is enabled or CDATA elements are allowed in the Advanced Content Filtering configuration, an attacker can exploit the faulty CDATA content detection to inject malformed HTML content. This can lead to the execution of arbitrary JavaScript code, posing a significant security risk to applications using CKEditor 4.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.24.0-lts
This is the first release that contains the fix.
npm install ckeditor4@4.24.0-ltsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating CKEditor 4 immediately is not feasible, a temporary workaround is to disable full-page editing mode and restrict the use of CDATA elements in the Advanced Content Filtering configuration. By doing so, the risk of exploiting this vulnerability can be mitigated. However, it is still strongly advised to update to the latest version as soon as possible.
Conclusion
The CKEditor 4 Cross-site Scripting vulnerability (CVE-2024-24815) poses a significant security risk to applications using CKEditor 4 versions prior to 4.24.0-lts. It is crucial to update to the latest version to ensure the vulnerability is addressed and to protect against potential attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is a popular HTML text editor used in web applications for creating and editing rich content.
All versions of CKEditor 4 prior to 4.24.0-lts are affected by this vulnerability.
The vulnerability allows an attacker to inject malicious HTML content and potentially execute JavaScript code, posing a security risk to applications using CKEditor 4.
To fix this vulnerability, update CKEditor 4 to version 4.24.0-lts or later.
A temporary workaround is to disable full-page editing mode and restrict the use of CDATA elements in the Advanced Content Filtering configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
