CVE-2024-24816: CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature
Summary
CVE-2024-24816: CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature. Affects ckeditor4 versions < 4.24.0-lts. Fixed in 4.24.0-lts. How to fix ↓
Also tracked for
- ckeditor · Debian:11
The same CVE-2024-24816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor4 is an open-source rich text editor used for web content creation. It provides a wide range of features and plugins that allow users to format and edit text in a web-based environment. One of the features provided by CKEditor4 is the preview feature, which allows users to preview the content before publishing it. This vulnerability affects the samples that use the preview feature, including the samples in the 'samples/old' directory and the samples in the 'plugins/[plugin name]/samples' directories. The vulnerability allows an attacker to execute arbitrary JavaScript code by exploiting a misconfiguration in the preview feature. This vulnerability affects all users of CKEditor4 versions prior to 4.24.0-lts with the affected samples used in a production environment.
Vulnerability Detail
The CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature allows an attacker to execute arbitrary JavaScript code. By abusing the misconfigured preview feature, an attacker can inject malicious code into the previewed content, which will be executed when the content is viewed by other users. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user. The vulnerability affects all users of CKEditor4 versions prior to 4.24.0-lts with the affected samples used in a production environment.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.24.0-lts
This is the first release that contains the fix.
npm install ckeditor4@4.24.0-ltsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the preview feature in the affected samples. This can be done by modifying the sample files and removing or commenting out the code related to the preview feature. However, this workaround should only be considered as a temporary solution, and upgrading to the patched version is strongly recommended.
Conclusion
The CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature can allow an attacker to execute arbitrary JavaScript code. It is important for users of CKEditor4 to upgrade to version 4.24.0-lts or later to mitigate this vulnerability. Additionally, disabling the preview feature in the affected samples can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor4 is an open-source rich text editor used for web content creation. It provides a wide range of features and plugins that allow users to format and edit text in a web-based environment.
The vulnerability affects the samples that use the preview feature, including the samples in the 'samples/old' directory and the samples in the 'plugins/[plugin name]/samples' directories.
The vulnerability allows an attacker to execute arbitrary JavaScript code by exploiting a misconfiguration in the preview feature. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user.
To fix this vulnerability, it is recommended to upgrade to CKEditor4 version 4.24.0-lts or later. The CKEditor team has recognized and patched the issue, and the fix is included in the mentioned version.
As a temporary workaround, users can disable the preview feature in the affected samples. This can be done by modifying the sample files and removing or commenting out the code related to the preview feature. However, upgrading to the patched version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
