CVE-2020-9281
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
CVE-2020-9281- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
CVE-2020-9281- Updated
- 2026-11-02
EUVDEUVD-2021-1200 No score
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
EUVD-2021-1200- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcjf-mgcg-jxjq
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
GHSA-vcjf-mgcg-jxjq- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
CVE-2020-9281- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vcjf-mgcg-jxjq
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
GHSA-vcjf-mgcg-jxjq- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-9281
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
UBUNTU-CVE-2020-9281- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-drupal-2020-9281 No score
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
- Record
BIT-drupal-2020-9281- Updated
- 2026-11-02
OSVUSN-5340-1 No score
ckeditor vulnerabilities
Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809)
Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)
Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695)
- Record
USN-5340-1- Updated
- 2026-11-02
OSVUSN-5340-2 No score
ckeditor vulnerabilities
USN-5340-1 fixed several vulnerabilities in CKEditor. This update provides the fixes for CVE-2018-9861, CVE-2020-9281, CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.
Original advisory details:
Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809)
Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)
Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695)
- Record
USN-5340-2- Updated
- 2026-11-02
Affected products
- ckeditor
- drupal
- fedoraproject fedora
- oracle agile product lifecycle management
- oracle application express
- oracle banking enterprise default management
- oracle banking enterprise default managment
- oracle jd edwards enterpriseone tools
- oracle peoplesoft enterprise peopletools
- oracle siebel apps - customer order management
- oracle webcenter portal
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckeditor4npm |
before 4.14.0 | 4.14.0 |
drupalBitnami |
8.7.0 up to 8.7.12, 8.8.0 up to 8.8.4 | 8.7.128.8.4 |
ckeditorUbuntu:Pro:16.04:LTS |
before 4.5.7+dfsg-2ubuntu0.16.04.1~esm1, plus listed versions 4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |
ckeditorUbuntu:18.04:LTS |
before 4.5.7+dfsg-2ubuntu0.18.04.1, plus listed versions 4.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.18.04.1 |
ckeditorUbuntu:20.04:LTS |
before 4.12.1+dfsg-1ubuntu0.1, plus listed versions 4.11.1+dfsg-14.12.1+dfsg-1 |
4.12.1+dfsg-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9281 is a medium vulnerability (CVSS 6.1) in Ckeditor, published March 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.31%, the 91st percentile. Fixed in ckeditor4 4.14.0.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO
oracle.com/security-alerts/cpuoct2020.html
github.com/ckeditor/ckeditor4
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-9281
ubuntu.com/security/CVE-2020-9281
cve.org/CVERecord?id=CVE-2020-9281