Ckeditor vulnerabilities
We track 3 vulnerabilities in Ckeditor products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Ckeditor vulnerabilities
- 8.1 High severity
ckeditor5: Improper Neutralization of Input During Web Page Generation
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribut
- 9.8 Critical severity
Ckeditor: Unrestricted Upload of File with Dangerous Type
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
- 7.5 High severity
ckeditor4: Inefficient Regular Expression Complexity
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significan