---
id: CVE-2021-41164
title: CKEditor4 is an open source WYSIWYG HTML editor
summary: >-
  CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a
  vulnerability has been discovered in the Advanced Content Filter (ACF) module
  and may affect all plugins used by CKEditor 4. The vulnerability allowed to
  inject malf…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L'
cwe:
  - CWE-79
  - CWE-79
vendor: ckeditor
product: ckeditor
affected:
  - 'ckeditor >= 4.0, < 4.17.0'
  - 'drupal >= 8.9.0, < 8.9.20'
  - 'drupal >= 9.1.0, < 9.1.14'
  - 'drupal >= 9.2.0, < 9.2.9'
  - 'banking_apis >= 18.1, <= 18.3'
  - banking_apis = 19.1
  - banking_apis = 19.2
  - banking_apis = 20.1
  - banking_apis = 21.1
  - 'banking_digital_experience >= 18.1, <= 18.3'
  - banking_digital_experience = 19.1
  - banking_digital_experience = 19.2
  - banking_digital_experience = 20.1
  - banking_digital_experience = 21.1
  - agile_product_lifecycle_management = 9.3.6
  - application_express < 22.1
  - commerce_guided_search = 11.3.2
  - peoplesoft_enterprise_peopletools = 8.58
  - peoplesoft_enterprise_peopletools = 8.59
  - webcenter_portal = 12.2.1.3.0
  - webcenter_portal = 12.2.1.4.0
  - fedora = 36
  - fedora = 37
patched:
  - ckeditor 4.17.0
  - drupal 9.2.9
  - application_express 22.1
published: '2021-11-17'
updated: '2026-08-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41164'
references:
  - url: 'https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
    label: security-advisories@github.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
    label: security-advisories@github.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
    label: security-advisories@github.com
  - url: 'https://www.drupal.org/sa-core-2021-011'
    label: security-advisories@github.com
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: security-advisories@github.com
  - url: 'https://www.oracle.com/security-alerts/cpujan2022.html'
    label: security-advisories@github.com
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: security-advisories@github.com
  - url: 'https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.drupal.org/sa-core-2021-011'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujan2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.01346
epssPercentile: 0.70237
ingestedAt: '2026-08-25T17:29:31.819Z'
---

## Overview

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

## Affected

- `ckeditor >= 4.0, < 4.17.0`
- `drupal >= 8.9.0, < 8.9.20`
- `drupal >= 9.1.0, < 9.1.14`
- `drupal >= 9.2.0, < 9.2.9`
- `banking_apis >= 18.1, <= 18.3`
- `banking_apis = 19.1`
- `banking_apis = 19.2`
- `banking_apis = 20.1`
- `banking_apis = 21.1`
- `banking_digital_experience >= 18.1, <= 18.3`
- `banking_digital_experience = 19.1`
- `banking_digital_experience = 19.2`
- `banking_digital_experience = 20.1`
- `banking_digital_experience = 21.1`
- `agile_product_lifecycle_management = 9.3.6`
- `application_express < 22.1`
- `commerce_guided_search = 11.3.2`
- `peoplesoft_enterprise_peopletools = 8.58`
- `peoplesoft_enterprise_peopletools = 8.59`
- `webcenter_portal = 12.2.1.3.0`
- `webcenter_portal = 12.2.1.4.0`
- `fedora = 36`
- `fedora = 37`

## Remediation

Upgrade past the affected range:

- `ckeditor 4.17.0`
- `drupal 9.2.9`
- `application_express 22.1`