CVE-2021-21254

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.

• CWE-400

• https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0Release Notes, Third Party Advisory
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wrThird Party Advisory
• https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm
• https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0Release Notes, Third Party Advisory
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wrThird Party Advisory
• https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm

Published

Jan 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21249OneDev is an all-in-one devops platform. In OneDev before ve…8.8
• CVE-2021-2125Vulnerability in the Oracle VM VirtualBox product of Oracle …4.6
• CVE-2021-21250OneDev is an all-in-one devops platform. In OneDev before ve…6.5
• CVE-2021-21251OneDev is an all-in-one devops platform. In OneDev before ve…8.8
• CVE-2021-21252The jQuery Validation Plugin provides drop-in validation for…7.5
• CVE-2021-21253OnlineVotingSystem is an open source project hosted on GitHu…5.3
• CVE-2021-21255GLPI is an open-source asset and IT management software pack…5.7
• CVE-2021-21257Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2021-21258GLPI is an open-source asset and IT management software pack…5.4
• CVE-2021-21259HedgeDoc is open source software which lets you create real-…6.1
• CVE-2021-2126Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2021-21260Online Invoicing System (OIS) is open source software which …5.4