CVE-2021-37695

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

• CWE-79
• CWE-79

• https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58Patch, Third Party Advisory
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhcThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://github.com/ckeditor/ckeditor4/commit/de3c001540715f9c3801aaa38a1917de46cfcf58Patch, Third Party Advisory
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhcThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Aug 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3769# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `…9.8
• CVE-2021-37690TensorFlow is an end-to-end open source platform for machine…6.6
• CVE-2021-37691TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37692TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-37693Discourse is an open-source platform for community discussio…7.5
• CVE-2021-37694@asyncapi/java-spring-cloud-stream-template generates a Spri…7.8
• CVE-2021-37696tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37697tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37698Icinga is a monitoring system which checks the availability …7.5
• CVE-2021-37699Next.js is an open source website development framework to b…6.1
• CVE-2021-3770vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37700@github/paste-markdown is an npm package for pasting markdow…6.1