CVE-2021-26272

Fixed in a distro release EPSS 2%

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Published 2021-01-26 · CVE record · OSV

Products: ckeditor, oracle agile_product_lifecycle_management, oracle application_express, oracle banking_party_management, oracle commerce_merchandising, oracle financial_services_analytical_applications_infrastructure, oracle financial_services_model_management_and_governance, oracle jd_edwards_enterpriseone_tools, oracle siebel_ui_framework, oracle webcenter_sites

Fixed upstream

Distro releases