CVE-2022-24729
Regular expression Denial of Service in dialog plugin
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Regular expression Denial of Service in dialog plugin
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
CVE-2022-24729- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-29580
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
EUVD-2022-29580- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
CVE-2022-24729- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVCVE-2022-24728
Cross-site Scripting in CKEditor4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
- Record
CVE-2022-24728- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Regular expression Denial of Service in dialog plugin
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
CVE-2022-24729- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
DEBIAN-CVE-2022-24729- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-4fc4-4p5g-6w89
Cross-site Scripting in CKEditor4
Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0.
Patches
The problem has been recognized and patched. The fix will be available in version 4.18.0.
For more information
Email us at [email protected] if you have any questions or comments about this advisory.
Acknowledgements
The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse (@kevinbackhouse) for recognizing and reporting this vulnerability.
- Record
GHSA-4fc4-4p5g-6w89- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
UBUNTU-CVE-2022-24729- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-drupal-2022-24728 No score
Cross-site Scripting in CKEditor4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
- Record
BIT-drupal-2022-24728- Updated
- 2026-11-02
OSVBIT-drupal-2022-24729 No score
Regular expression Denial of Service in dialog plugin
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.
- Record
BIT-drupal-2022-24729- Updated
- 2026-11-02
OSVDRUPAL-CORE-2022-005 No score
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.
Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.
For more information, see CKEditor's security advisories:
- CVE-2022-24728: HTML processing vulnerability allowing to execute JavaScript code
- CVE-2022-24729: Regular expression Denial of Service in dialog plugin
This advisory is not covered by Drupal Steward.
- Record
DRUPAL-CORE-2022-005- Updated
- 2026-11-02
Affected products
- ckeditor
- ckeditor ckeditor4
- drupal
- fedoraproject fedora
- oracle application express
- oracle commerce merchandising
- oracle financial services analytical applications infrastructure
- oracle financial services behavior detection platform
- oracle financial services trade-based anti money laundering
- oracle peoplesoft enterprise peopletools
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupalBitnami From an advisory covering 2 CVEs |
8.0.0 up to 9.2.15, 9.3.0 up to 9.3.8 | 9.2.159.3.8 |
ckeditorDebian:12 |
before 4.19.0+dfsg-1 | 4.19.0+dfsg-1 |
drupal/corePackagist From an advisory covering 2 CVEs |
8.0.0 up to 9.2.15, 9.3.0 up to 9.3.8, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.2.159.3.8 |
ckeditor4npm From an advisory covering 2 CVEs |
before 4.18.0 | 4.18.0 |
ldap-account-managerUbuntu:16.04:LTS |
All versions, plus listed versions 4.9-15.1-15.2-15.2-1ubuntu1 |
None known |
request-tracker4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.2.11-24.2.12-34.2.12-44.2.12-5 |
None known |
ckeditor3Ubuntu:18.04:LTS |
All versions, plus listed versions 3.6.6.1+dfsg-1 |
None known |
ldap-account-managerUbuntu:18.04:LTS |
All versions, plus listed versions 5.7-16.1-16.2-1 |
None known |
request-tracker4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.4.1-54.4.2-14.4.2-24.4.2-2ubuntu0.1~esm1 |
None known |
ckeditor3Ubuntu:20.04:LTS |
All versions, plus listed versions 3.6.6.1+dfsg-33.6.6.1+dfsg-4 |
None known |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ldap-account-managerUbuntu:20.04:LTS |
All versions, plus listed versions 6.7-1 |
None known |
request-tracker4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.4.3-24.4.3-2+deb10u3build0.20.04.1 |
None known |
ckeditor3Ubuntu:22.04:LTS |
All versions, plus listed versions 3.6.6.1+dfsg-7 |
None known |
ldap-account-managerUbuntu:22.04:LTS |
All versions, plus listed versions 7.5-17.7-1 |
None known |
request-tracker4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu1.22.04.1 |
None known |
ckeditor3Ubuntu:24.04:LTS |
All versions, plus listed versions 3.6.6.1+dfsg-7 |
None known |
ldap-account-managerUbuntu:24.04:LTS |
All versions, plus listed versions 8.3-18.5-1 |
None known |
request-tracker4Ubuntu:24.04:LTS |
All versions, plus listed versions 4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu24.4.7+dfsg-1 |
None known |
ldap-account-managerUbuntu:25.10 |
All versions, plus listed versions 9.0-1 |
None known |
request-tracker4Ubuntu:25.10 |
All versions, plus listed versions 4.4.7+dfsg-4syncable1 |
None known |
ldap-account-managerUbuntu:26.04:LTS |
All versions, plus listed versions 9.0-19.0-1build1 |
None known |
request-tracker4Ubuntu:26.04:LTS |
All versions, plus listed versions 4.4.7+dfsg-4syncable1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24729 is a medium vulnerability (CVSS 6.5) in Ckeditor, published March 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in ckeditor 4.19.0+dfsg-1.
References
ckeditor.com/cke4/release/CKEditor-4.18.0
github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
oracle.com/security-alerts/cpujul2022.html
drupal.org/sa-core-2022-005
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-24728
security-tracker.debian.org/tracker/CVE-2022-24729
securitylab.github.com/advisories/GHSL-2022-009_ckeditor4
ubuntu.com/security/CVE-2022-24729
cve.org/CVERecord?id=CVE-2022-24729
Left out here: 183 versions. The JSON record has them.