CVE-2021-21391
published 2021-04-29CVE-2021-21391: CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list…
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
1.67%
73.8th percentile
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ckeditor | ckeditor5 | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-engine | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-engine | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-font | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-font | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-image | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-image | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-list | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-list | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-markdown-gfm | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-markdown-gfm | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-media-embed | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-media-embed | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-paste-from-office | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-paste-from-office | >= 0 < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-widget | < 27.0.0 | 27.0.0 |
| ckeditor | ckeditor5-widget | >= 0 < 27.0.0 | 27.0.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-21391: CKEditor 5 provides a WYSIWYG editing solution
osv·2021-04-29·CVSS 6.5
CVE-2021-21391 [MEDIUM] CVE-2021-21391: CKEditor 5 provides a WYSIWYG editing solution
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0.
OSV
Regular expression Denial of Service in multiple packages
osv·2021-04-06
CVE-2021-21391 [MEDIUM] Regular expression Denial of Service in multiple packages
Regular expression Denial of Service in multiple packages
### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.
### Patches
The problem has been recognized and patched. The fix will be available in version 27.0.0.
### For more information
Email us at [email protected] if you have any questions or comments about this advisory.
### Acknowledgements
The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.
GHSA
Regular expression Denial of Service in multiple packages
ghsa·2021-04-06
CVE-2021-21391 [MEDIUM] CWE-400 Regular expression Denial of Service in multiple packages
Regular expression Denial of Service in multiple packages
### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.
### Patches
The problem has been recognized and patched. The fix will be available in version 27.0.0.
### For more information
Email us at [email protected] if you have any questions or comments about this advisory.
### Acknowledgements
The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-3rh3-wfr4-76mjhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-enginehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-fonthttps://www.npmjs.com/package/%40ckeditor/ckeditor5-imagehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-listhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfmhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-media-embedhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-paste-from-officehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-widgethttps://github.com/ckeditor/ckeditor5/security/advisories/GHSA-3rh3-wfr4-76mjhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-enginehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-fonthttps://www.npmjs.com/package/%40ckeditor/ckeditor5-imagehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-listhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfmhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-media-embedhttps://www.npmjs.com/package/%40ckeditor/ckeditor5-paste-from-officehttps://www.npmjs.com/package/%40ckeditor/ckeditor5-widget
2021-04-29
Published