# CVE-2024-24816: CKEditor4 cross-site scripting in samples with preview feature

Source: https://junglewise.ai/threats/cve-2024-24816-ckeditor4-cross-site-scripting-in-samples-with-preview-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-24816 · Severity: low · CVSS 3.1 · Published 2024-02-07

CKEditor4 is a widely-used rich-text editor component for web applications. A cross-site scripting (XSS) vulnerability in certain sample files shipped with CKEditor4 allows attackers to execute malicious JavaScript code in users' browsers if those samples are deployed in production environments. This could lead to account compromise, session hijacking, or malware distribution.

Technologies: [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-24816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-24816 being exploited in the wild.

**How severe is CVE-2024-24816?** Low severity, with a CVSS score of 3.1, published 7 February 2024.

**Which products and versions are affected?** ckeditor4 (npm) SEMVER:introduced=0,fixed=4.24.0-lts.

**Is there a fix for CVE-2024-24816?** Yes. ckeditor4 (npm): upgrade to 4.24.0-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-24816 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-24816?** Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckeditor4 (npm): upgrade to 4.24.0-lts or later

  ```sh
  npm install ckeditor4@4.24.0-lts
  ```


## Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw in CKEditor4 sample files that use the preview feature, specifically in samples/old/**/*.html and plugins/[plugin name]/samples/**/*.html. The root cause is a misconfigured preview feature in these samples that does not properly sanitize or restrict JavaScript execution. An attacker can exploit this by crafting malicious input that, when previewed, executes arbitrary JavaScript in the victim's browser context. This requires user interaction (opening/previewing the payload) but does not require authentication. The vulnerability only affects integrators who deploy these sample files directly in production code. A patch is available in CKEditor4 4.24.0-lts and later versions.

## Affected products

- CKSource CKEditor4 < 4.24.0-lts

## Identifiers

- CVE-2024-24816
- GHSA-mw2c-vx6j-mg76

## Timeline

- 2024-02-07: disclosed
- 2024-02-07: patched: Fix available in version 4.24.0-lts

## References

- [https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-mw2c-vx6j-mg76)

## Related threats

- [CKEditor4 cross-site scripting via domain takeover](https://junglewise.ai/threats/cve-2024-43411-ckeditor4-cross-site-scripting-via-domain-takeover)
- [CKEditor 4 Code Snippet GeSHi plugin reflected XSS](https://junglewise.ai/threats/cve-2024-43407-ckeditor-4-code-snippet-geshi-plugin-reflected-xss)
- [CKEditor cross-site scripting in AJAX sample](https://junglewise.ai/threats/cve-2023-4771-ckeditor-cross-site-scripting-in-ajax-sample)
- [CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection](https://junglewise.ai/threats/cve-2024-24815-ckeditor4-cross-site-scripting-in-html-parsing-with-incorrect)
- [CKEditor Cross-site Scripting in sample page](https://junglewise.ai/threats/ckeditor-cross-site-scripting-in-sample-page-ca465607)