CVE-2022-24729: Ckeditor

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.18.0 (fixed in 4.18.0)
• Drupal Drupal: from 8.0.0, before 9.2.15 (fixed in 9.2.15); from 9.3.0, before 9.3.8 (fixed in 9.3.8)
• Fedoraproject Fedora: version 36 only; version 37 only
• Oracle Application Express: before 22.1.1 (fixed in 22.1.1)
• Oracle Commerce Merchandising: version 11.3.2 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.7.0.0, up to and including 8.1.0.0.0; version 8.1.1.0 only; version 8.1.2.0 only; version 8.1.2.1 only
• Oracle Financial Services Behavior Detection Platform: from 8.1.1.0, up to and including 8.1.2.1; version 8.0.7.0 only; version 8.0.8.0 only
• Oracle Financial Services Trade-Based Anti Money Laundering: version 8.0.7 only; version 8.0.8 only
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only

Published 2022-03-16. Last modified 2026-06-17.