# CVE-2024-43407: CKEditor 4 Code Snippet GeSHi plugin reflected XSS

Source: https://junglewise.ai/threats/cve-2024-43407-ckeditor-4-code-snippet-geshi-plugin-reflected-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-43407 · Severity: low · CVSS 3.1 · Published 2024-08-21

CKEditor 4 is a widely-used rich text editor embedded in web applications to allow users to create and format content. A reflected cross-site scripting vulnerability in the bundled GeSHi syntax highlighter plugin allows attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted URL, potentially compromising user sessions or stealing sensitive data.

Technologies: [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4), [ckeditor/ckeditor (Packagist)](https://junglewise.ai/threats/technologies/ckeditor-ckeditor). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2024-43407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-43407 being exploited in the wild.

**How severe is CVE-2024-43407?** Low severity, with a CVSS score of 3.1, published 21 August 2024.

**Which products and versions are affected?** ckeditor4 (npm) SEMVER:introduced=0,fixed=4.25.0; ckeditor/ckeditor (Packagist) ECOSYSTEM:introduced=0,fixed=4.25.0.

**Is there a fix for CVE-2024-43407?** Yes. ckeditor4 (npm): upgrade to 4.25.0 or later; ckeditor/ckeditor (Packagist): upgrade to 4.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-43407 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-43407?** Check whether you run ckeditor4 (npm) or ckeditor/ckeditor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckeditor4 (npm): upgrade to 4.25.0 or later

  ```sh
  npm install ckeditor4@4.25.0
  ```

- ckeditor/ckeditor (Packagist): upgrade to 4.25.0 or later

  ```sh
  composer require ckeditor/ckeditor:^4.25.0
  ```


## Technical details

A reflected XSS vulnerability exists in the Code Snippet GeSHi plugin included with CKEditor 4, stemming from improper handling of input in the GeSHi syntax highlighter library (an unmaintained third-party dependency). An attacker can craft a malicious request to the GeSHi library hosted on a PHP web server to execute arbitrary JavaScript in the victim's browser. The attack requires user interaction (victim clicking a malicious link), but no authentication is needed. The vulnerability affects all CKEditor 4 versions prior to 4.25.0-lts, in which the GeSHi library has been removed entirely. Integrators wishing to continue using GeSHi are advised to source it independently and review its security posture.

## Affected products

- CKSource CKEditor 4 before 4.25.0-lts

## Identifiers

- CVE-2024-43407
- GHSA-7r32-vfj5-c2jv

## Timeline

- 2024-08-21: disclosed
- 2024-08-21: patched: Fixed in version 4.25.0-lts

## References

- [https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7r32-vfj5-c2jv)

## Related threats

- [CKEditor4 cross-site scripting via domain takeover](https://junglewise.ai/threats/cve-2024-43411-ckeditor4-cross-site-scripting-via-domain-takeover)
- [CKEditor cross-site scripting in AJAX sample](https://junglewise.ai/threats/cve-2023-4771-ckeditor-cross-site-scripting-in-ajax-sample)
- [CKEditor4 cross-site scripting in samples with preview feature](https://junglewise.ai/threats/cve-2024-24816-ckeditor4-cross-site-scripting-in-samples-with-preview-feature)
- [CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection](https://junglewise.ai/threats/cve-2024-24815-ckeditor4-cross-site-scripting-in-html-parsing-with-incorrect)
- [CKEditor Cross-site Scripting in sample page](https://junglewise.ai/threats/ckeditor-cross-site-scripting-in-sample-page-ca465607)