cve.bz

CVE-2021-33829

6.1 mediumEPSS 3.2%

Medium (6.1). EPSS 3.2% chance of exploitation in the next 30 days. Fixed in ckeditor4 4.16.1.

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rgx6-rjj4-c388npmckeditor4>=4.14.0 <4.16.14.16.1
GHSA-rgx6-rjj4-c388Packagistdrupal/core>=7.0.0 <7.807.80
GHSA-rgx6-rjj4-c388Packagistdrupal/core>=8.0.0 <8.9.168.9.16
GHSA-rgx6-rjj4-c388Packagistdrupal/core>=9.0.0 <9.0.149.0.14
GHSA-rgx6-rjj4-c388Packagistdrupal/core>=9.1.0 <9.1.99.1.9
GHSA-rgx6-rjj4-c388Packagistdrupal/drupal>=7.0.0 <7.807.80
GHSA-rgx6-rjj4-c388Packagistdrupal/drupal>=8.0.0 <8.9.168.9.16
GHSA-rgx6-rjj4-c388Packagistdrupal/drupal>=9.0.0 <9.0.149.0.14
GHSA-rgx6-rjj4-c388Packagistdrupal/drupal>=9.1.0 <9.1.99.1.9

References

Check your stackJSON