# CVE-2021-33829: CKEditor 4 cross-site scripting in HTML Data Processor

Source: https://junglewise.ai/threats/cve-2021-33829-ckeditor-4-cross-site-scripting-in-html-data-processor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-33829 · Severity: low · CVSS 3.1 · Published 2021-05-26

CKEditor 4 is a widely-used rich text editor embedded in web applications and content management systems like Drupal to allow users to create and edit formatted content. A vulnerability in its HTML parser allows attackers to inject and execute malicious JavaScript code through specially-crafted HTML comments, potentially compromising user sessions, stealing credentials, or defacing content visible to other users.

Technologies: [CKEditor 4](https://junglewise.ai/threats/technologies/ckeditor-4), [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core), [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core). Vendors: [CKEditor](https://junglewise.ai/threats/vendors/ckeditor), [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2021-33829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-33829 being exploited in the wild.

**How severe is CVE-2021-33829?** Low severity, with a CVSS score of 3.1, published 26 May 2021.

**Which products and versions are affected?** CKEditor 4 4.14.0 through 4.16.0; Drupal Core 7.0.0 through 7.79, 8.0.0 through 8.9.15, 9.0.0 through 9.0.13, 9.1.0 through 9.1.8; drupal/core (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.9.16|ECOSYSTEM:introduced=9.0.0,fixed=9.0.14|ECOSYSTEM:introduced=9.1.0,fixed=9.1.9.

**Is there a fix for CVE-2021-33829?** Yes. drupal/core (Packagist): upgrade to 8.9.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-33829 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-33829?** Check whether you run CKEditor 4, Drupal Core or drupal/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- drupal/core (Packagist): upgrade to 8.9.16 or later

  ```sh
  composer require drupal/core:^8.9.16
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in the HTML Data Processor component of CKEditor 4 versions 4.14.0 through 4.16.0, caused by improper handling of HTML comment syntax (specifically the sequence `--!>`). An attacker can craft malicious HTML containing executable JavaScript that bypasses the parser's sanitization, allowing code injection if the input is processed by a vulnerable CKEditor instance. The attack requires user interaction (the user must view or process content containing the payload) but does not require authentication. The vulnerability affects CKEditor 4 npm package (fixed in 4.16.1) and Drupal core versions 7.x through 9.x (fixed in 7.80, 8.9.16, 9.0.14, and 9.1.9 respectively). A patch is available.

## Affected products

- CKEditor CKEditor 4 4.14.0 through 4.16.0
- Drupal Drupal Core 7.0.0 through 7.79, 8.0.0 through 8.9.15, 9.0.0 through 9.0.13, 9.1.0 through 9.1.8

## Identifiers

- CVE-2021-33829
- DRUPAL-CORE-2021-003
- GHSA-rgx6-rjj4-c388

## Timeline

- 2021-06-09: disclosed: Vulnerability published on NVD
- 2021-06-21: advisory: GitHub Security Advisory GHSA-rgx6-rjj4-c388 published
- 2021-06-21: patched: CKEditor 4.16.1 released with fix; Drupal patches available

## References

- [https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/](https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/)

## Related threats

- [Drupal core Link module cross-site scripting in markup sanitization](https://junglewise.ai/threats/cve-2026-108515-drupal-core-2026-015-the-drupal-core-link-module-provides-a)
- [Drupal Navigation module cross-site scripting in attributes](https://junglewise.ai/threats/cve-2026-108514-drupal-core-2026-016-the-navigation-module-doesn-t-sufficiently)
- [Drupal Core remote code execution in Field UI module](https://junglewise.ai/threats/cve-2026-108097-drupal-core-2026-014-a-remote-code-execution-vulnerability)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [Drupal stored cross-site scripting in Layout Builder](https://junglewise.ai/threats/cve-2026-55805-drupal-stored-cross-site-scripting-in-layout-builder)