CVE catalog

CVE-2021-41165

ckeditor3: CVE-2021-41165

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.57% · Oct 25, 2026

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianckeditorbookworm4.19.1+dfsg-1fixed
Debianckeditor3bookworm3.6.6.1+dfsg-7vulnerable
Ubuntuckeditorpro4.16.0+dfsg-2vulnerable
Ubuntuckeditorpro4.16.2+dfsg-1vulnerable
Ubuntuckeditorpro4.16.2+dfsg-1ubuntu0.1~esm1vulnerable
Ubuntuckeditorpro4.16.2+dfsg-1ubuntu0.1~esm2vulnerable
Ubuntuldap-account-manager16.044.9-1vulnerable
Ubuntuldap-account-manager16.045.1-1vulnerable
Ubuntuldap-account-manager16.045.2-1vulnerable
Ubuntuldap-account-manager16.045.2-1ubuntu1vulnerable
Ubunturequest-tracker416.044.2.11-2vulnerable
Ubunturequest-tracker416.044.2.12-3vulnerable
Ubunturequest-tracker416.044.2.12-4vulnerable
Ubunturequest-tracker416.044.2.12-5vulnerable
Ubuntuckeditor318.043.6.6.1+dfsg-1vulnerable
Ubuntuldap-account-manager18.045.7-1vulnerable
Ubuntuldap-account-manager18.046.1-1vulnerable
Ubuntuldap-account-manager18.046.2-1vulnerable
Ubunturequest-tracker4pro4.4.1-5vulnerable
Ubunturequest-tracker4pro4.4.2-1vulnerable
Ubunturequest-tracker4pro4.4.2-2vulnerable
Ubunturequest-tracker4pro4.4.2-2ubuntu0.1~esm1vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-3vulnerable
Ubuntuckeditor320.043.6.6.1+dfsg-4vulnerable
Ubuntuldap-account-manager20.046.7-1vulnerable
Ubunturequest-tracker420.044.4.3-2vulnerable
Ubunturequest-tracker420.044.4.3-2+deb10u3build0.20.04.1vulnerable
Ubuntuckeditor322.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager22.047.5-1vulnerable
Ubuntuldap-account-manager22.047.7-1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker422.044.4.4+dfsg-2ubuntu1.22.04.1vulnerable
Ubuntuckeditor324.043.6.6.1+dfsg-7vulnerable
Ubuntuldap-account-manager24.048.3-1vulnerable
Ubuntuldap-account-manager24.048.5-1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu1vulnerable
Ubunturequest-tracker424.044.4.4+dfsg-2ubuntu2vulnerable
Ubunturequest-tracker424.044.4.7+dfsg-1vulnerable
Ubuntuldap-account-manager25.109.0-1vulnerable
Ubunturequest-tracker425.104.4.7+dfsg-4syncable1vulnerable
Ubuntuldap-account-manager26.049.0-1vulnerable
Ubuntuldap-account-manager26.049.0-1build1vulnerable
Ubunturequest-tracker426.044.4.7+dfsg-4syncable1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianckeditorsourcebookworm4.19.0+dfsg-1not yet assignedNot reported[999909]
Debianckeditor3sourcebookworm(unfixed)not yet assignedNot reported[1015217]

[Debian bug #999909][Debian bug #1015217]

Notes

[bookworm] ckeditor3: Minor issue, only used by Horde editor

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ckeditor3]Affected
    Details (2)

    • 3.6.6.1+dfsg-7 · all · bookworm

      Affected

      dsa · ckeditor3 · debian · bookworm; dsa · ckeditor3 · debian · 12

    • 3.6.6.1+dfsg-7 · all · bookworm

      Affected

      dsa · ckeditor3 · debian · bookworm; dsa · ckeditor3 · debian · 12

  • [ckeditor]Fixed
    Details (2)

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.19.0+dfsg-1

      dsa · ckeditor · debian · bookworm; dsa · ckeditor · debian · 12

    • 4.19.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 4.19.0+dfsg-1

      dsa · ckeditor · debian · bookworm; dsa · ckeditor · debian · 12

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]