Medium severity6.1NVD Advisory· Published Jun 9, 2021· Updated Jun 17, 2026
CVE-2021-33829
CVE-2021-33829
Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ckeditor4npm | >= 4.14.0, < 4.16.1 | 4.16.1 |
drupal/corePackagist | >= 7.0.0, < 7.80 | 7.80 |
drupal/corePackagist | >= 8.0.0, < 8.9.16 | 8.9.16 |
drupal/corePackagist | >= 9.0.0, < 9.0.14 | 9.0.14 |
drupal/corePackagist | >= 9.1.0, < 9.1.9 | 9.1.9 |
drupal/drupalPackagist | >= 7.0.0, < 7.80 | 7.80 |
drupal/drupalPackagist | >= 8.0.0, < 8.9.16 | 8.9.16 |
drupal/drupalPackagist | >= 9.0.0, < 9.0.14 | 9.0.14 |
drupal/drupalPackagist | >= 9.1.0, < 9.1.9 | 9.1.9 |
Affected products
11- CKEditor/CKEditor 4description
- ghsa-coords4 versions
>= 4.14.0, < 4.16.1+ 3 more
- (no CPE)range: >= 4.14.0, < 4.16.1
- (no CPE)range: >= 7.0.0, < 7.80
- (no CPE)range: >= 7.0.0, < 7.80
- (no CPE)range: >= 8.9.0, < 8.9.16
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
14- ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/nvdPatchRelease NotesVendor AdvisoryWEB
- www.drupal.org/sa-core-2021-003nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-rgx6-rjj4-c388ghsaADVISORY
- lists.debian.org/debian-lts-announce/2021/11/msg00007.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-33829ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yamlghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3TghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGWghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XDghsaWEB
- www.npmjs.com/package/ckeditor4ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/nvd
News mentions
0No linked articles in our index yet.