{"id":"CVE-2024-24815","aliases":["DEBIAN-CVE-2024-24815","EUVD-2024-0630","GHSA-fq6h-4g8v-qqvm","UBUNTU-CVE-2024-24815","USN-7258-1","openSUSE-SU-2024:14557-1","openSUSE-SU-2025:0008-1"],"status":"published","title":"CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00706,"percentile":0.53823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-02-07T15:14:32Z","modified":"2026-11-02T12:01:35Z","fixes":[{"ecosystem":"npm","package":"ckeditor4","fixed_in":["4.24.0-lts"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"ckeditor/ckeditor","fixed_in":["4.24.0"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-django-ckeditor","fixed_in":["6.7.2-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"python-django-ckeditor","fixed_in":["6.7.2-bp155.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-django-ckeditor","fixed_in":["6.7.2-bp155.3.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ckeditor4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.24.0-lts"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"ckeditor/ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.24.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.19.1+dfsg-1","4.22.1+dfsg-1","4.22.1+dfsg1-2"]},{"source":"osv","ecosystem":"Debian:12","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-7"]},{"source":"osv","ecosystem":"npm","package":"ckeditor4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.24.0-lts"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ckeditor/ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.24.0"}]}],"versions":["4.10.0","4.10.1","4.11.0","4.11.1","4.11.2","4.11.3","4.11.4","4.12.0","4.12.1","4.13.0","4.13.1","4.14.0","4.14.1","4.15.0","4.15.1","4.16.0","4.16.1","4.16.2","4.17.0","4.17.1","4.17.2","4.18.0","4.19.0","4.19.1","4.20.0","4.20.1","4.20.2","4.21.0","4.22.0","4.22.1","4.23.0","4.3.3","4.3.4","4.3.5","4.4.0","4.4.1","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.5.0","4.5.1","4.5.10","4.5.11","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.9.0","4.9.1","4.9.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg1-3","4.5.6+dfsg-1","4.5.7+dfsg-1","4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.16.04.1~esm1","4.5.7+dfsg-2ubuntu0.16.04.1~esm2","4.5.7+dfsg-2ubuntu0.16.04.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9-1","5.1-1","5.2-1","5.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.11-2","4.2.12-3","4.2.12-4","4.2.12-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.18.04.1","4.5.7+dfsg-2ubuntu0.18.04.1+esm1","4.5.7+dfsg-2ubuntu0.18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-5","4.4.2-1","4.4.2-2","4.4.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1+dfsg-1","4.12.1+dfsg-1","4.12.1+dfsg-1ubuntu0.1","4.12.1+dfsg-1ubuntu0.1+esm1","4.12.1+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-3","3.6.6.1+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-2","4.4.3-2+deb10u3build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5-1","7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.0+dfsg-2","4.16.2+dfsg-1","4.16.2+dfsg-1ubuntu0.1~esm1","4.16.2+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-1","8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu2","4.4.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.22.1+dfsg1-2","4.22.1+dfsg1-2ubuntu0.24.04.1~esm1","4.22.1+dfsg1-2ubuntu0.24.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.22.1+dfsg1-2ubuntu1","4.22.1+dfsg1-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0-1","9.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.7+dfsg-2ubuntu0.16.04.1~esm2"}]}],"versions":["4.4.4+dfsg1-3","4.5.6+dfsg-1","4.5.7+dfsg-1","4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.16.04.1~esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.7+dfsg-2ubuntu0.18.04.1+esm1"}]}],"versions":["4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.18.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.1+dfsg-1ubuntu0.1+esm1"}]}],"versions":["4.11.1+dfsg-1","4.12.1+dfsg-1","4.12.1+dfsg-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.16.0+dfsg-2","4.16.2+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.1+dfsg1-2ubuntu0.24.04.1~esm1"}]}],"versions":["4.22.1+dfsg1-2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-django-ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"python-django-ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-bp155.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-django-ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-bp155.3.3.1"}]}]}],"products":[{"vendor":"ckeditor","product":"ckeditor"},{"vendor":"ckeditor","product":"ckeditor4"}],"references":[{"url":"https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://www.drupal.org/sa-contrib-2024-009","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24815","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fq6h-4g8v-qqvm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24815.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24815","tags":["advisory"]},{"url":"https://github.com/ckeditor/ckeditor4","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-24815","tags":["report"]},{"url":"https://github.com/ckeditor/ckeditor4/commit/889315aa89de1d08f320990367ef4559551fdf9f","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24815","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7258-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-24816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43411","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTZL2Q6MD2MZXWLTDIWGVIWV5USTFGZF/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24815","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZXNT2JPQVYWDQRDN2YJ7KJCRBY5QEJQW/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219720","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-24815","title":"CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T15:14:32.361Z","modified":"2025-02-13T17:40:30.582Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-0630","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T15:14:32Z","modified":"2025-02-13T17:40:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:47.088299Z"}],"ghsa":[{"id":"GHSA-fq6h-4g8v-qqvm","title":"CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection","description":"### Affected packages\nThe vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that:\n* Enabled [full-page editing](https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) mode,\n* or enabled [CDATA](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata) elements in [Advanced Content Filtering](https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html) configuration (defaults to `script` and `style` elements).\n\n### Impact\n\nA potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. It affects all users using the CKEditor 4 at version \u003c 4.24.0-lts.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 4.24.0-lts.\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.\n\n### Acknowledgements\nThe CKEditor 4 team would like to thank [Michal Frýba](https://cz.linkedin.com/in/michal-fryba) from [ALEF NULA](https://www.alefnula.com/) for recognizing and reporting this vulnerability.","status":"published","published":"2024-02-07T17:30:37Z","modified":"2024-03-06T15:35:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2024-24815","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T16:15:47.753Z","modified":"2026-06-17T07:14:56.55Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:35.738752Z"}],"osv":[{"id":"CVE-2024-24815","title":"CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T15:14:32.361Z","modified":"2026-10-28T02:30:42.322658822Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24815","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T16:15:47.753Z","modified":"2026-11-02T12:01:35.279435298Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-fq6h-4g8v-qqvm","title":"CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection","description":"### Affected packages\nThe vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that:\n* Enabled [full-page editing](https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) mode,\n* or enabled [CDATA](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata) elements in [Advanced Content Filtering](https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html) configuration (defaults to `script` and `style` elements).\n\n### Impact\n\nA potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. It affects all users using the CKEditor 4 at version \u003c 4.24.0-lts.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 4.24.0-lts.\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.\n\n### Acknowledgements\nThe CKEditor 4 team would like to thank [Michal Frýba](https://cz.linkedin.com/in/michal-fryba) from [ALEF NULA](https://www.alefnula.com/) for recognizing and reporting this vulnerability.","status":"published","published":"2024-02-07T17:30:37Z","modified":"2026-09-10T03:50:06.171222645Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2024-24815","description":"CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.","status":"published","published":"2024-02-07T16:15:00Z","modified":"2026-05-20T16:16:37.478570188Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"openSUSE-SU-2024:14557-1","title":"python310-django-ckeditor-6.7.2-1.1 on GA media","description":"These are all security issues fixed in the python310-django-ckeditor-6.7.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-06T00:00:00Z","modified":"2026-02-04T02:38:51.221448Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0008-1","title":"Security update for python-django-ckeditor","description":"This update for python-django-ckeditor fixes the following issues:\n\n- Update to 6.7.2\n  * Deprecated the package.\n  * Added a new ckeditor/fixups.js script which disables the version check again \n    (if something slips through by accident) and which disables the behavior \n    where CKEditor 4 would automatically attach itself to unrelated HTML elements \n    with a contenteditable attribute (see CKEDITOR.disableAutoInline in the \n    CKEditor 4 docs).\n- CVE-2024-24815: Fixed bypass of Advanced Content Filtering mechanism (boo#1219720)\n\n- update to 6.7.1:\n  * Add Python 3.12, Django 5.0\n  * Silence the CKEditor version check/nag but include a system check warning\n\n- update to 6.7.0:\n  * Dark mode fixes.\n  * Added support for Pillow 10.\n\n- update to 6.6.1:\n  * Required a newer version of django-js-asset which actually works\n    with Django 4.1.\n  * CKEditor 4.21.0\n  * Fixed the CKEditor styles when used with the dark Django admin theme.\n\n- update to 6.5.1:\n  * Avoided calling ``static()`` if ``CKEDITOR_BASEPATH`` is defined.\n  * Fixed ``./manage.py generateckeditorthumbnails`` to work again after the\n    image uploader backend rework.\n  * CKEditor 4.19.1\n  * Stopped calling ``static()`` during application startup.\n  * Added Django 4.1\n  * Changed the context for the widget to deviate less from Django. Removed a\n  * few template variables which are not used in the bundled\n  * ``ckeditor/widget.html`` template. This only affects you if you are using a\n  * customized widget or widget template.\n  * Dropped support for Python \u003c 3.8, Django \u003c 3.2.\n  * Added a pre-commit configuration.\n  * Added a GitHub action for running tests.\n  * Made selenium tests require opt in using a ``SELENIUM=firefox`` or\n    ``SELENIUM=chromium`` environment variable.\n  * Made it possible to override the CKEditor template in the widget class.\n  * Changed ``CKEDITOR_IMAGE_BACKEND`` to require dotted module paths (the old\n    identifiers are still supported for now).\n","status":"published","published":"2025-01-07T17:02:06Z","modified":"2026-02-04T04:05:40.76484Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-7258-1","title":"ckeditor vulnerabilities","description":"Kevin Backhouse discovered that CKEditor did not properly sanitize HTML\ncontent. An attacker could possibly use this issue to perform cross site\nscripting and obtain sensitive information. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-24728)\n\nIt was discovered that CKEditor did not properly handle the creation of\neditor instances in the Iframe Dialog and Media Embed packages. An\nattacker could possibly use this issue to perform cross site scripting\nand obtain sensitive information. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2023-28439)\n\nIt was discovered that CKEditor did not properly handle parsing HTML\ncontent. An attacker could possibly use this issue to perform cross site\nscripting and obtain sensitive information.\n(CVE-2024-24815, CVE-2024-24816)\n\nIt was discovered that CKEditor did not properly sanitize version\nnotifications. An attacker could possibly use this issue to perform cross\nsite scripting and obtain sensitive information. This issue only affected\nUbuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)\n","status":"published","published":"2025-02-06T01:26:17Z","modified":"2026-06-25T13:32:30.047678093Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}