Drupal core - SA-CORE-2021-003
Update: 2021-06-11: Added CVE-2021-33829 identifier
Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. CKEditor 4.16.1 and later include the fix.
Update: 2021-06-11: More details are available on CKEditor's blog.
Users of the CKEditor library via means other than Drupal core should update their 3rd party code (e.g. the WYSIWYG module for Drupal 7). The Drupal Security Team policy is not to alert for issues affecting 3rd party libraries unless those are shipped with Drupal core. See DRUPAL-SA-PSA-2016-004 for more details.
This issue is mitigated by the fact that it only affects sites with CKEditor enabled.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/core | >= 8.0.0, < 8.9.16, >= 9.0.0, < 9.0.14, >= 9.1.0, < 9.1.9 | 8.9.16, 9.0.14, 9.1.9 |
| Composer package | drupal/drupal | >= 7.0.0, < 7.80, >= 8.0.0, < 8.9.16, >= 9.0.0, < 9.0.14, >= 9.1.0, < 9.1.9 | 7.80, 8.9.16, 9.0.14, 9.1.9 |
| Drupal (core) | drupal/core | >= 8.0.0, < 8.9.16, >= 9.0.0, < 9.0.14, >= 9.1.0, < 9.1.9 | 8.9.16, 9.0.14, 9.1.9 |
| npm package | ckeditor4 | >= 4.14.0, < 4.16.1 | 4.16.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-33829
- https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2021-33829.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2021-33829.yaml
- https://github.com/ckeditor/ckeditor4
- https://lists.debian.org/debian-lts-announce/2021/11/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD
- https://www.drupal.org/sa-core-2021-003
- https://www.npmjs.com/package/ckeditor4
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer, Drupal, npm
- Package
drupal/core, drupal/drupal, ckeditor4- Disclosed
- 26.05.2021
- Updated
- 11.10.2026 13:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rgx6-rjj4-c388 - CC BY 4.0
OSV / GitHub Advisory Database - DRUPAL-CORE-2021-003 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: ckeditor4
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 05.2021 08.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 11
Disclosures per year
- 2021: 8
- 2022: 2
- 2023: 0
- 2024: 5
- 2025: 0
- 2026: 0
-
Drupal core - SA-CORE-2021-003 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.