HTML comments vulnerability allowing to execute JavaScript code

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the core HTML processing module of CKEditor 4 versions prior to 4.17.0. The flaw allows malformed comment HTML to bypass content sanitization, potentially enabling JavaScript execution. This affects all plugins using the editor's core processing [1][2].

Exploitation

An attacker can inject specially crafted, malformed HTML comments into editor content. No authentication is required if the editor is publicly accessible, but exploitation typically relies on a victim (e.g., an administrator) viewing or processing the malicious content. The attack does not require user interaction beyond normal content rendering [1][2].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's browser session. This can result in data theft, session hijacking, or other client-side attacks. The vulnerability is classified as XSS with a moderate severity rating [2][4].

Mitigation

The vulnerability is fixed in CKEditor 4.17.0, released November 17, 2021 [1][2]. Users should upgrade to this version or later. For those unable to upgrade, no official workaround is documented; however, Drupal (which integrates CKEditor) released corresponding patches in versions 8.9.20, 9.1.14, and 9.2.9 [4]. CKEditor 4 reached end-of-life on June 30, 2023, and later versions under the Extended Support Model (4.22.1 and below) may require a commercial license for continued security updates [3].