CVE-2021-41165: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days.

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Affected products

• Ckeditor Ckeditor: before 4.17.0 (fixed in 4.17.0)
• Drupal Drupal: from 8.9.0, before 8.9.20 (fixed in 8.9.20); from 9.1.0, before 9.1.14 (fixed in 9.1.14); from 9.2.0, before 9.2.9 (fixed in 9.2.9)
• Oracle Agile Product Lifecycle Management: version 9.3.6 only
• Oracle Application Express: before 22.1 (fixed in 22.1)
• Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
• Oracle Banking Digital Experience: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
• Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-11-17. Last modified 2026-06-17.