Is CVE-2021-41165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-41165 being exploited in the wild.

How severe is CVE-2021-41165?

Low severity, with a CVSS score of 3.1, published 17 November 2021.

Which products and versions are affected?

ckeditor4 (npm) SEMVER:introduced=0,fixed=4.17.0; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.17.0.

Is there a fix for CVE-2021-41165?

Yes. ckeditor4 (npm): upgrade to 4.17.0 or later; ckeditor/ckeditor (Packagist): upgrade to 4.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-41165 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-41165?

Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-41165: CKEditor 4 XSS via malformed HTML comments

CVE-2021-41165 · Severity: low · CVSS 3.1 · Published 2021-11-17

CKEditor 4 is a rich-text editor component used in web applications to allow users to create and edit formatted content. A vulnerability in its HTML processing module allows attackers to bypass content sanitization by injecting malformed HTML comments, enabling arbitrary JavaScript execution within the editor context or in pages displaying untrusted content.

Technologies: ckeditor4 (npm), ckeditor/ckeditor (Packagist). Vendors: npm, Packagist.

Quick answers

Is CVE-2021-41165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-41165 being exploited in the wild.
How severe is CVE-2021-41165?: Low severity, with a CVSS score of 3.1, published 17 November 2021.
Which products and versions are affected?: ckeditor4 (npm) SEMVER:introduced=0,fixed=4.17.0; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.17.0.
Is there a fix for CVE-2021-41165?: Yes. ckeditor4 (npm): upgrade to 4.17.0 or later; ckeditor/ckeditor (Packagist): upgrade to 4.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-41165 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-41165?: Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ckeditor4 (npm): upgrade to 4.17.0 or later
```
npm install ckeditor4@4.17.0
```
ckeditor/ckeditor (Packagist): upgrade to 4.17.0 or later
```
composer require ckeditor/ckeditor:^4.17.0
```

Technical details

CKEditor 4 versions prior to 4.17.0 contain a cross-site scripting (XSS) vulnerability in the core HTML processing module. The vulnerability stems from improper handling of malformed HTML comments during content sanitization. An attacker can craft malformed comment syntax to bypass the editor's content filters and inject executable JavaScript code. Attack requires either authenticated access to create/edit content in CKEditor 4 or user interaction (e.g., pasting or importing untrusted HTML). The vulnerability affects all CKEditor 4 plugins that rely on the core HTML processing. A patch is available in version 4.17.0.

Affected products

CKSource CKEditor 4 < 4.17.0

Identifiers

CVE-2021-41165
GHSA-7h26-63m7-qhf2

Timeline

2021-11-17: disclosed
2021-11-17: patched: Fixed in version 4.17.0

References

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.