CVE-2021-32809: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected products

• Ckeditor Ckeditor: from 4.5.2, before 4.16.2 (fixed in 4.16.2)
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Oracle Application Express: before 21.1.4 (fixed in 21.1.4)
• Oracle Banking Party Management: version 2.7.0 only
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Commerce Merchandising: version 11.3.2 only
• Oracle Documaker: version 12.6.3 only; version 12.6.4 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.7, up to and including 8.1.1
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only

Published 2021-08-12. Last modified 2026-06-17.