CVE-2021-32808

npm/ckeditor4 CVE-2021-32808: high 7.6, EPSS 1.19%

Widget feature vulnerability allowing to execute JavaScript code using undo functionality

Action: Upgrade ckeditor4 to 4.16.2 or later.

npm i ckeditor4@4.16.2

Affected

Fixed versions

Sources

• osv: GHSA-6226-h7ff-ch6c
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c
• https://nvd.nist.gov/vuln/detail/CVE-2021-32808
• https://github.com/ckeditor/ckeditor4
• https://github.com/ckeditor/ckeditor4/releases/tag/4.16.2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

CVE-2021-32808 · published 2021-08-23T19:40:48Z · modified 2026-07-08T06:28:18.242088680Z · JSON