{"cve":"CVE-2021-41164","nvd":{"published":"2021-11-17T19:15:08.913","modified":"2026-08-25T16:28:27.310","status":"Modified","description":"CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417","https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/","https://www.drupal.org/sa-core-2021-011"],"products":["ckeditor:ckeditor","drupal:drupal","fedoraproject:fedora","oracle:agile_product_lifecycle_management","oracle:application_express","oracle:banking_apis","oracle:banking_digital_experience","oracle:commerce_guided_search","oracle:peoplesoft_enterprise_peopletools","oracle:webcenter_portal"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-41164","score":0.01346,"percentile":0.71435,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pvmx-g8h5-cprj","url":"https://osv.dev/vulnerability/GHSA-pvmx-g8h5-cprj","summary":"Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML","modified":"2026-07-08T06:28:08.168219118Z","packages":[{"ecosystem":"npm","name":"ckeditor4","purl":"pkg:npm/ckeditor4","ranges":["<4.17.0"],"fixed":["4.17.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}