GHSA-7h26-63m7-qhf2 high
HTML comments vulnerability allowing to execute JavaScript code
Affected range
SEMVER: introduced 0; fixed 4.17.0Fixed versions: 4.17.0
ckeditor4
JavaScript WYSIWYG web text editor.
npm latest 4.25.2 SEE LICENSE IN LICENSE.md
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
4.25.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
15 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-6226-h7ff-ch6c high
Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Affected range
SEMVER: introduced 4.13.0; fixed 4.16.2Fixed versions: 4.16.2
GHSA-pvmx-g8h5-cprj high
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Affected range
SEMVER: introduced 0; fixed 4.17.0Fixed versions: 4.17.0
GHSA-m94c-37g6-cjhc high
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Affected range
SEMVER: introduced 0; fixed 4.16.2Fixed versions: 4.16.2
GHSA-mw2c-vx6j-mg76 moderate
CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature
Affected range
SEMVER: introduced 0; fixed 4.24.0-ltsFixed versions: 4.24.0-lts
GHSA-fq6h-4g8v-qqvm moderate
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection
Affected range
SEMVER: introduced 0; fixed 4.24.0-ltsFixed versions: 4.24.0-lts
GHSA-7889-rm5j-hpgg moderate
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
Affected range
SEMVER: introduced 4.5.2; fixed 4.16.2Fixed versions: 4.16.2
GHSA-rgx6-rjj4-c388 moderate
ckeditor4 vulnerable to cross-site scripting
Affected range
SEMVER: introduced 4.14.0; fixed 4.16.1Fixed versions: 4.16.1
GHSA-4fc4-4p5g-6w89 moderate
Cross-site Scripting in CKEditor4
Affected range
SEMVER: introduced 0; fixed 4.18.0Fixed versions: 4.18.0
GHSA-7r32-vfj5-c2jv moderate
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability
Affected range
SEMVER: introduced 0; fixed 4.25.0Fixed versions: 4.25.0
GHSA-6v96-m24v-f58j moderate
CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Affected range
SEMVER: introduced 4.22.0; fixed 4.25.0Fixed versions: 4.25.0
GHSA-wh5w-82f3-wrxh moderate
CKEditor cross-site scripting vulnerability in AJAX sample
Affected range
SEMVER: introduced 0; fixed 4.24.0-ltsFixed versions: 4.24.0-lts
GHSA-vcjf-mgcg-jxjq moderate
CKEditor 4.0 vulnerability in the HTML Data Processor
Affected range
SEMVER: introduced 0; fixed 4.14.0Fixed versions: 4.14.0
GHSA-wpvm-wqr4-p7cw moderate
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Affected range
SEMVER: introduced 0; fixed 4.16.0Fixed versions: 4.16.0
GHSA-4m44-5j2g-xf64 moderate
Improper Neutralization of Input During Web Page Generation in CKEditor4
Affected range
SEMVER: introduced 0; fixed 4.15.1Fixed versions: 4.15.1