CVE-2021-33829: Ckeditor

Medium severity, CVSS 6.1. EPSS: 3.2% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Affected products

• Ckeditor Ckeditor: from 4.14.0, before 4.16.1 (fixed in 4.16.1)
• Debian Debian Linux: version 9.0 only
• Drupal Drupal: from 8.9.0, before 8.9.16 (fixed in 8.9.16); from 9.0.0, before 9.0.14 (fixed in 9.0.14); from 9.1.0, before 9.1.9 (fixed in 9.1.9)
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only

Published 2021-06-09. Last modified 2026-06-17.