CVE-2021-37695: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected products

• Ckeditor Ckeditor: before 4.16.2 (fixed in 4.16.2)
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Oracle Application Express: before 21.1.4 (fixed in 21.1.4)
• Oracle Banking Party Management: version 2.7.0 only
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Commerce Merchandising: version 11.3.2 only
• Oracle Documaker: version 12.6.3 only; version 12.6.4 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.7, up to and including 8.1.1; version 8.0.3 only
• Oracle Financial Services Model Management And Governance: from 8.0.8.0.0, up to and including 8.1.0.0.0
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only

Published 2021-08-13. Last modified 2026-06-17.