CVE-2021-41164: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.17.0 (fixed in 4.17.0)
• Drupal Drupal: from 8.9.0, before 8.9.20 (fixed in 8.9.20); from 9.1.0, before 9.1.14 (fixed in 9.1.14); from 9.2.0, before 9.2.9 (fixed in 9.2.9)
• Fedoraproject Fedora: version 36 only; version 37 only
• Oracle Agile Product Lifecycle Management: version 9.3.6 only
• Oracle Application Express: before 22.1 (fixed in 22.1)
• Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
• Oracle Banking Digital Experience: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
• Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-11-17. Last modified 2026-08-25.