Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/ckeditor@4.11.2
purl pkg:npm/ckeditor@4.11.2
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score
Vulnerabilities affecting this package (7)
Advisory Summary Fixed in package version
CVE-2021-32809
Aliases:
GHSA-7889-rm5j-hpgg
Code Injection ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered … There are no reported fixed by versions.
CVE-2021-26271

Inclusion of Functionality from Untrusted Control Sphere It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading … There are no reported fixed by versions.
CVE-2023-28439
Aliases:
GHSA-vh5c-xwqv-cv9g
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site … There are no reported fixed by versions.
CVE-2022-24729
Aliases:
GHSA-f6rf-9m92-x2hh
Improper Input Validation CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in … There are no reported fixed by versions.
CVE-2021-37695
Aliases:
GHSA-m94c-37g6-cjhc
Cross-site Scripting ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered … There are no reported fixed by versions.
CVE-2021-26272

Inclusion of Functionality from Untrusted Control Sphere It was possible to execute a ReDoS-type attack inside CKEditor 4 by persuading … There are no reported fixed by versions.
CVE-2022-24728
Aliases:
GHSA-4fc4-4p5g-6w89
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability … There are no reported fixed by versions.
This package is not known to fix any advisories.