ckeditor4 (npm)
Advisories
16
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.25.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install ckeditor4@4.25.0yarn
yarn add ckeditor4@4.25.0pnpm
pnpm add ckeditor4@4.25.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6v96-m24v-f58j CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover |
Low EPSS 0.43% |
>= 4.22.0, < 4.25.0 | 4.25.0 |
| GHSA-7r32-vfj5-c2jv Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability |
Medium EPSS 0.45% |
< 4.25.0 | 4.25.0 |
| GHSA-mw2c-vx6j-mg76 CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature |
Medium EPSS 1.65% |
< 4.24.0-lts | 4.24.0-lts |
| GHSA-fq6h-4g8v-qqvm CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection |
Medium EPSS 0.71% |
< 4.24.0-lts | 4.24.0-lts |
| GHSA-hxjc-9j8v-v9pr Duplicate Advisory: CKEditor Cross-site Scripting vulnerability Withdrawn |
Medium | <= 4.15.1 | No fix yet |
| GHSA-wh5w-82f3-wrxh CKEditor cross-site scripting vulnerability in AJAX sample |
Medium EPSS 0.88% |
< 4.24.0-lts | 4.24.0-lts |
| GHSA-4m44-5j2g-xf64 Improper Neutralization of Input During Web Page Generation in CKEditor4 |
Medium EPSS 2.05% |
< 4.15.1 | 4.15.1 |
| GHSA-4fc4-4p5g-6w89 Cross-site Scripting in CKEditor4 |
Medium EPSS 2.49% |
< 4.18.0 | 4.18.0 |
| GHSA-7h26-63m7-qhf2 HTML comments vulnerability allowing to execute JavaScript code |
High EPSS 1.57% |
< 4.17.0 | 4.17.0 |
| GHSA-pvmx-g8h5-cprj Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML |
High EPSS 1.35% |
< 4.17.0 | 4.17.0 |
| GHSA-wpvm-wqr4-p7cw Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4 |
Medium EPSS 2.35% |
< 4.16.0 | 4.16.0 |
| GHSA-m94c-37g6-cjhc Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML. |
High EPSS 1.32% |
< 4.16.2 | 4.16.2 |
| GHSA-7889-rm5j-hpgg Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality |
Medium EPSS 1.19% |
>= 4.5.2, < 4.16.2 | 4.16.2 |
| GHSA-6226-h7ff-ch6c Widget feature vulnerability allowing to execute JavaScript code using undo functionality |
High EPSS 1.19% |
>= 4.13.0, < 4.16.2 | 4.16.2 |
| GHSA-rgx6-rjj4-c388 ckeditor4 vulnerable to cross-site scripting |
Medium EPSS 3.19% |
>= 4.14.0, < 4.16.1 | 4.16.1 |
| GHSA-vcjf-mgcg-jxjq CKEditor 4.0 vulnerability in the HTML Data Processor |
Medium EPSS 4.31% |
< 4.14.0 | 4.14.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor