# CVE-2021-37695: CKEditor 4 Fake Objects cross-site scripting via malformed HTML

Source: https://junglewise.ai/threats/cve-2021-37695-ckeditor-4-fake-objects-cross-site-scripting-via-malformed-html  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-37695 · Severity: low · CVSS 3.1 · Published 2021-08-23

CKEditor 4 is a popular rich text editor used in web applications to allow users to create and edit formatted content. The Fake Objects plugin in CKEditor 4, which is used by several dependent plugins, contains a cross-site scripting vulnerability that allows attackers to inject and execute malicious JavaScript code by crafting specially malformed HTML. This could allow attackers to steal user session data, modify page content, or perform actions on behalf of authenticated users.

Technologies: [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-37695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-37695 being exploited in the wild.

**How severe is CVE-2021-37695?** Low severity, with a CVSS score of 3.1, published 23 August 2021.

**Which products and versions are affected?** ckeditor4 (npm) SEMVER:introduced=0,fixed=4.16.2.

**Is there a fix for CVE-2021-37695?** Yes. ckeditor4 (npm): upgrade to 4.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-37695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-37695?** Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckeditor4 (npm): upgrade to 4.16.2 or later

  ```sh
  npm install ckeditor4@4.16.2
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the Fake Objects plugin (CWE-79) that occurs when processing malformed HTML in fake object elements. The vulnerability allows injection of JavaScript code through specially crafted HTML that bypasses the plugin's sanitization logic. Attack requires user interaction (the victim must be using an affected CKEditor 4 plugin instance with user input) and network access to a vulnerable application. An attacker can execute arbitrary JavaScript in the context of the editor user's browser, potentially accessing sensitive data or performing unauthorized actions. The vulnerability affects CKEditor 4 versions prior to 4.16.2, which was released as a patch in August 2021.

## Affected products

- CKSource CKEditor 4 < 4.16.2

## Identifiers

- CVE-2021-37695
- GHSA-m94c-37g6-cjhc

## Timeline

- 2021-08-12: disclosed
- 2021-08-23: patched: Version 4.16.2 released

## References

- [https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc)

## Related threats

- [CKEditor4 cross-site scripting via domain takeover](https://junglewise.ai/threats/cve-2024-43411-ckeditor4-cross-site-scripting-via-domain-takeover)
- [CKEditor 4 Code Snippet GeSHi plugin reflected XSS](https://junglewise.ai/threats/cve-2024-43407-ckeditor-4-code-snippet-geshi-plugin-reflected-xss)
- [CKEditor cross-site scripting in AJAX sample](https://junglewise.ai/threats/cve-2023-4771-ckeditor-cross-site-scripting-in-ajax-sample)
- [CKEditor4 cross-site scripting in samples with preview feature](https://junglewise.ai/threats/cve-2024-24816-ckeditor4-cross-site-scripting-in-samples-with-preview-feature)
- [CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection](https://junglewise.ai/threats/cve-2024-24815-ckeditor4-cross-site-scripting-in-html-parsing-with-incorrect)