VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 7, 2014· Updated May 6, 2026

CVE-2014-5191

CVE-2014-5191

Description

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ckeditor/ckeditorPackagist
< 4.4.34.4.3

Affected products

3
  • Fckeditor/Ckeditor3 versions
    cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:*range: <=4.4.2
    • cpe:2.3:a:ckeditor:ckeditor:4.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ckeditor:ckeditor:4.4.1:*:*:*:*:*:*:*

Patches

1
b685874c6bc8

Prevent from DOM clobbering.

https://github.com/ckeditor/ckeditor4Piotrek Reinmar KoszulińskiJul 7, 2014via ghsa
commit
1 file changed · +8 −5
  • plugins/preview/preview.html+8 −5 modified
    @@ -1,10 +1,13 @@
 <script>
 
-var doc = document;
-doc.open();
-doc.write( window.opener._cke_htmlToLoad );
-doc.close();
+// Prevent from DOM clobbering.
+if ( typeof window.opener._cke_htmlToLoad == 'string' ) {
+	var doc = document;
+	doc.open();
+	doc.write( window.opener._cke_htmlToLoad );
+	doc.close();
 
-delete window.opener._cke_htmlToLoad;
+	delete window.opener._cke_htmlToLoad;
+}
 
 </script>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.