CVE-2021-32809
Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
CVE-2021-32809- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2021-1613
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
EUVD-2021-1613- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7889-rm5j-hpgg
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
Affected packages
The vulnerability has been discovered in clipboard plugin. All plugins with clipboard plugin dependency are affected:
Impact
A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.
Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.
For more information
Email us at [email protected] if you have any questions or comments about this advisory.
Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin (skavans) for recognizing and reporting this vulnerability.
- Record
GHSA-7889-rm5j-hpgg- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
NVD
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
CVE-2021-32809- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-94, CWE-79
- Updated
- 2026-11-02
OSV
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
CVE-2021-32809- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-32809
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
DEBIAN-CVE-2021-32809- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-7889-rm5j-hpgg
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
Affected packages
The vulnerability has been discovered in clipboard plugin. All plugins with clipboard plugin dependency are affected:
Impact
A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.
Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.
For more information
Email us at [email protected] if you have any questions or comments about this advisory.
Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin (skavans) for recognizing and reporting this vulnerability.
- Record
GHSA-7889-rm5j-hpgg- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32809
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Clipboard package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
- Record
UBUNTU-CVE-2021-32809- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-5340-1 No score
ckeditor vulnerabilities
Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809)
Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)
Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695)
- Record
USN-5340-1- Updated
- 2026-11-02
OSVUSN-5340-2 No score
ckeditor vulnerabilities
USN-5340-1 fixed several vulnerabilities in CKEditor. This update provides the fixes for CVE-2018-9861, CVE-2020-9281, CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.
Original advisory details:
Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809)
Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)
Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695)
- Record
USN-5340-2- Updated
- 2026-11-02
Affected products
- ckeditor
- ckeditor ckeditor4
- fedoraproject fedora
- oracle application express
- oracle banking party management
- oracle commerce guided search
- oracle commerce merchandising
- oracle documaker
- oracle financial services analytical applications infrastructure
- oracle jd edwards enterpriseone tools
- oracle peoplesoft enterprise peopletools
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckeditor4npm |
4.5.2 up to 4.16.2 | 4.16.2 |
ckeditorDebian:12 |
before 4.16.2+dfsg-1 | 4.16.2+dfsg-1 |
ckeditorUbuntu:Pro:16.04:LTS |
before 4.5.7+dfsg-2ubuntu0.16.04.1~esm1, plus listed versions 4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |
ckeditorUbuntu:18.04:LTS |
before 4.5.7+dfsg-2ubuntu0.18.04.1, plus listed versions 4.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.18.04.1 |
ckeditorUbuntu:20.04:LTS |
before 4.12.1+dfsg-1ubuntu0.1, plus listed versions 4.11.1+dfsg-14.12.1+dfsg-1 |
4.12.1+dfsg-1ubuntu0.1 |
ckeditorUbuntu:18.04:LTS From an advisory covering 6 CVEs |
before 4.5.7+dfsg-2ubuntu0.18.04.1, plus listed versions 4.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.18.04.1 |
ckeditorUbuntu:20.04:LTS From an advisory covering 6 CVEs |
before 4.12.1+dfsg-1ubuntu0.1, plus listed versions 4.11.1+dfsg-14.12.1+dfsg-1 |
4.12.1+dfsg-1ubuntu0.1 |
ckeditorUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 4.5.7+dfsg-2ubuntu0.16.04.1~esm1, plus listed versions 4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-2 |
4.5.7+dfsg-2ubuntu0.16.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32809 is a medium vulnerability (CVSS 4.6) in Ckeditor, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in ckeditor4 4.16.2.
References
github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T
oracle.com/security-alerts/cpuoct2021.html
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-32809
security-tracker.debian.org/tracker/CVE-2021-32809
ubuntu.com/security/CVE-2021-32809
cve.org/CVERecord?id=CVE-2021-32809