CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0.
References
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:30
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
10 May 2021, 18:22
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:ckeditor:ckeditor5-engine:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-image:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-font:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-list:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-media-embed:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-widget:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-markdown-gfm:*:*:*:*:*:node.js:*:* cpe:2.3:a:ckeditor:ckeditor5-paste-from-office:*:*:*:*:*:node.js:*:* |
|
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-image - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-list - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-font - Product, Third Party Advisory | |
References | (CONFIRM) https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-3rh3-wfr4-76mj - Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-paste-from-office - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-engine - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-media-embed - Product, Third Party Advisory | |
References | (MISC) https://www.npmjs.com/package/@ckeditor/ckeditor5-widget - Product, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.5 |
29 Apr 2021, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-29 01:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-21391
Mitre link : CVE-2021-21391
CVE.ORG link : CVE-2021-21391
JSON object : View
Products Affected
ckeditor
- ckeditor5-media-embed
- ckeditor5-list
- ckeditor5-markdown-gfm
- ckeditor5-image
- ckeditor5-widget
- ckeditor5-paste-from-office
- ckeditor5-engine
- ckeditor5-font
CWE
CWE-400
Uncontrolled Resource Consumption