CVE-2021-33829
Fixed in a distro release EPSS 3%
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Products: ckeditor, fedoraproject fedora, drupal, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 7.80 |
| Packagist | drupal/core | 8.9.16 |
| Packagist | drupal/core | 9.0.14 |
| Packagist | drupal/core | 9.1.9 |
| Packagist | drupal/drupal | 7.80 |
| Packagist | drupal/drupal | 8.9.16 |
| Packagist | drupal/drupal | 9.0.14 |
| Packagist | drupal/drupal | 9.1.9 |
| npm | ckeditor4 | 4.16.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | drupal | 9.1.10-1 |
| Debian 12 | ckeditor | 4.16.0+dfsg-2 |
| Debian 12 | ckeditor3 | no fix |
| Debian 9 | ckeditor | 4.5.7+dfsg-2+deb9u1 |
| Ubuntu 18.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.18.04.1 |
| Ubuntu 20.04 LTS | ckeditor | 4.12.1+dfsg-1ubuntu0.1 |
| Ubuntu Pro 16.04 LTS | ckeditor | 4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |