CVE-2021-37695

—

CVSS 3.1

5.4 medium

EPSS

1%p69

Published

Aug 13, 2021 (Aug 13, 2021)

Modified

Jun 17, 2026

Description

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Vendors: ckeditor debian fedoraproject oracle
Products: ckeditor, debian linux, fedora, application express, banking party management, commerce guided search, commerce merchandising, documaker, financial services analytical applications infrastructure, financial services model management and governance, jd edwards enterpriseone tools, peoplesoft enterprise peopletools
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.