CVE-2021-33829

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-33829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-33829
Aliases
Downstream
Published
2021-06-09T12:15:07Z
Modified
2025-10-27T12:04:58.816683Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

References

Affected packages

Git / github.com/ckeditor/ckeditor-releases

Affected ranges

Type
GIT
Repo
https://github.com/ckeditor/ckeditor-releases
Events
Introduced
0d574568baeddda92f231681ea5aac4860dca4e4
Fixed
a0d9ddd4b80b3dcc1d1bc8c2acc2d43e4c96b660

Affected versions

standard/4.*

standard/4.14.0
standard/4.14.1
standard/4.15.0
standard/4.15.1
standard/4.16.0

Git / github.com/ckeditor/ckeditor4

Affected ranges

Type
GIT
Repo
https://github.com/ckeditor/ckeditor4
Events
Introduced
8a12b041718e05eeffb62a931d95995ac72cbe22
Fixed
cae20318d46745cc46c811da4e7d68b38ca32449

Affected versions

4.*

4.14.0
4.14.1
4.15.0
4.15.1
4.16.0

Git / github.com/drupal/drupal

Affected ranges

Type
GIT
Repo
https://github.com/drupal/drupal
Events
Introduced
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70
Fixed
1667e06929722a8d913ef989cc00f70a38129d6d

Affected versions

8.*

8.9.0
8.9.1
8.9.10
8.9.11
8.9.12
8.9.13
8.9.14
8.9.15
8.9.2
8.9.3
8.9.4
8.9.5
8.9.6
8.9.8
8.9.9