CVE-2021-41164

MediumCVSS 5.4/10Last modified Aug 25, 2026

Description

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2021
Last modified: Aug 25, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411655.4CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module CVE-2021-411665.3The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may CVE-2021-411677.5modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a CVE-2021-411686.5Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown CVE-2021-411694.8Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross s CVE-2021-41174.3yetiforcecrm is vulnerable to Business Logic Errors CVE-2021-411709.8neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the tem CVE-2021-411718.8eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to by CVE-2021-411725.4AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to CVE-2021-411735.7Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to cra CVE-2021-411746.1Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to vis CVE-2021-411755.4Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDN