CVE-2022-24728: Cross-site Scripting in CKEditor4
Summary
CVE-2022-24728: Cross-site Scripting in CKEditor4. Affects ckeditor4 versions < 4.18.0. Fixed in 4.18.0. How to fix ↓
Also tracked for
- drupal · Bitnami
- ckeditor · Debian:11
- drupal/core · Packagist
The same CVE-2022-24728 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CKEditor 4 is a widely used HTML text editor that provides a rich set of features for creating and editing content. It is commonly integrated into web applications to enable users to input and format text. However, a vulnerability has been discovered in the core HTML processing module of CKEditor 4, which may affect all plugins used by the editor. This vulnerability allows for the injection of malformed HTML, bypassing content sanitization and potentially leading to the execution of malicious JavaScript code. The vulnerability impacts CKEditor 4 versions prior to 4.18.0.
Vulnerability Detail
The CKEditor 4 vulnerability arises from a flaw in the HTML processing core module. Attackers can exploit this vulnerability by injecting specially crafted HTML code that evades content sanitization mechanisms. This can result in the execution of arbitrary JavaScript code within the context of the affected user's browser, potentially leading to various attacks such as session hijacking, defacement, or theft of sensitive information. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 4.25.2 as of 22 Oct 2026
npm install ckeditor4@4.25.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.18.0
This is the first release that contains the fix.
npm install ckeditor4@4.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional input validation and sanitization measures on the server-side to mitigate the risk of XSS attacks. This can involve using security libraries or frameworks that provide robust input filtering and output encoding capabilities. However, applying the official patch by upgrading to CKEditor 4 version 4.18.0 is the recommended long-term solution.
Conclusion
The CKEditor 4 vulnerability (CVE-2022-24728) exposes web applications to the risk of cross-site scripting (XSS) attacks. It is crucial for users of CKEditor 4 to promptly update to version 4.18.0 or later to mitigate this vulnerability. Implementing additional server-side input validation and sanitization measures can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ckeditor4 →
FAQ
CKEditor 4 is a popular HTML text editor used in web applications for content creation and editing.
The vulnerability allows for the injection of malicious JavaScript code, potentially leading to various attacks such as session hijacking, defacement, or theft of sensitive information.
All CKEditor 4 versions prior to 4.18.0 are affected by this vulnerability.
To fix this vulnerability, upgrade CKEditor 4 to version 4.18.0 or later.
As a temporary workaround, implement additional input validation and sanitization measures on the server-side.
References
Related vulnerabilities
Recent vulnerabilities recorded for ckeditor4.
