CVE-2021-26272
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Risk Assessment
An attacker can cause significant slowdown or freezing of the victim's browser, potentially leading to denial of service for the individual user.
Recommendation
Update CKEditor to version 4.16 or later to mitigate the ReDoS vulnerability.
Other vulnerabilities in CKEditor
See all- CVE-2023-31541Critical
The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.
- CVE-2020-9281Medium
CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).
- CVE-2021-26271Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
- CVE-2020-27193Medium
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of the editor inputs.
Original NVD description (English source)
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).