# CVE-2021-21254: CKEditor 5 Markdown plugin regular expression denial of service

Source: https://junglewise.ai/threats/cve-2021-21254-ckeditor-5-markdown-plugin-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-01-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-21254 · Severity: low · CVSS 3.1 · Published 2021-01-29

CKEditor 5 is a popular rich-text editor used in web applications to allow users to create and edit content. The Markdown plugin contains a flaw in its link recognition logic that can be exploited by sending specially crafted input, causing the editor to consume excessive CPU and freeze the browser tab, disrupting user productivity.

Vendors: [CKSource](https://junglewise.ai/threats/vendors/cksource), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-21254 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21254 being exploited in the wild.

**How severe is CVE-2021-21254?** Low severity, with a CVSS score of 3.1, published 29 January 2021.

**Which products and versions are affected?** CKSource CKEditor 5 Markdown plugin <= 24.0.0; @ckeditor/ckeditor5-markdown-gfm (npm) SEMVER:introduced=0,fixed=25.0.0.

**Is there a fix for CVE-2021-21254?** Yes. @ckeditor/ckeditor5-markdown-gfm (npm): upgrade to 25.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-21254 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-21254?** Check whether you run CKSource CKEditor 5 Markdown plugin or @ckeditor/ckeditor5-markdown-gfm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @ckeditor/ckeditor5-markdown-gfm (npm): upgrade to 25.0.0 or later

  ```sh
  npm install @ckeditor/ckeditor5-markdown-gfm@25.0.0
  ```


## Technical details

A regular expression denial of service (ReDoS) vulnerability exists in the CKEditor 5 Markdown plugin's link recognition regex pattern (CWE-400). An attacker can craft input containing specific character sequences that trigger catastrophic backtracking in the regex engine, causing significant performance degradation and browser tab freeze. The vulnerability affects versions up to 24.0.0 and requires network access to a web application using the vulnerable plugin, with no authentication or user interaction required beyond viewing or entering text. The fix is available in version 25.0.0 or users can mitigate by disabling the Markdown plugin entirely.

## Affected products

- CKSource CKEditor 5 Markdown plugin <= 24.0.0

## Identifiers

- CVE-2021-21254
- GHSA-hgmg-hhc8-g5wr

## Timeline

- 2021-01-29: disclosed
- 2021: patched: Fix available in version 25.0.0

## References

- [https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr](https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr)

## Related threats

- [CKEditor5 cross-site scripting in editor destroy process](https://junglewise.ai/threats/cve-2022-31175-ckeditor5-cross-site-scripting-in-editor-destroy-process)