CVE-2021-41164

CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.

• CWE-79
• CWE-79

• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417Patch, Third Party Advisory
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprjThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
• https://www.drupal.org/sa-core-2021-011Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
• https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417Patch, Third Party Advisory
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprjThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
• https://www.drupal.org/sa-core-2021-011Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41159FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2021-4116yetiforcecrm is vulnerable to Improper Neutralization of Inp…5.4
• CVE-2021-41160FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2021-41161Combodo iTop is a web based IT Service Management tool. In v…6.1
• CVE-2021-41162Combodo iTop is a web based IT Service Management tool. In 3…6.1
• CVE-2021-41163Discourse is an open source platform for community discussio…9.8
• CVE-2021-41165CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41166The Nextcloud Android app is the Android client for Nextclou…5.3
• CVE-2021-41167modern-async is an open source JavaScript tooling library fo…7.5
• CVE-2021-41168Snudown is a reddit-specific fork of the Sundown Markdown pa…6.5
• CVE-2021-41169Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3