CVE-2020-9281

The vulnerability is a stored cross-site scripting (XSS) issue in CKEditor 4's HTML Data Processor. The processor improperly handles "protected" comments using the cke_protected syntax, allowing an attacker to inject arbitrary HTML or JavaScript [1]. This affects CKEditor 4.0 through 4.13.

To exploit, an attacker must craft a comment with cke_protected markers containing malicious code. When the editor processes the HTML, the comment is stripped but the code remains, leading to XSS when the content is rendered. The attack requires no authentication if the editor is used on a publicly accessible page.

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's session, potentially leading to data theft, session hijacking, or defacement. The vulnerability is rated medium severity.

The issue is fixed in CKEditor 4.14 released in February 2020 [1]. Users should upgrade. CKEditor 4 reached end of life in June 2023, but commercial LTS support continues until December 2028 [2]. No workaround is mentioned.