CVE-2022-24728: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.18.0 (fixed in 4.18.0)
• Drupal Drupal: from 8.0.0, before 9.2.15 (fixed in 9.2.15); from 9.3.0, before 9.3.8 (fixed in 9.3.8)
• Fedoraproject Fedora: version 36 only; version 37 only
• Oracle Application Express: before 22.1.1 (fixed in 22.1.1)
• Oracle Commerce Merchandising: version 11.3.2 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.7.0.0, up to and including 8.1.0.0.0; version 8.1.1.0 only; version 8.1.2.0 only; version 8.1.2.1 only
• Oracle Financial Services Behavior Detection Platform: from 8.1.1.0, up to and including 8.1.2.1; version 8.0.7.0 only; version 8.0.8.0 only
• Oracle Financial Services Trade-Based Anti Money Laundering: version 8.0.7 only; version 8.0.8 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only

Published 2022-03-16. Last modified 2026-06-17.