CVE-2021-21391
Summary
| CVE | CVE-2021-21391 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-04-29 01:15:00 UTC |
| Updated | 2023-11-07 03:30:00 UTC |
| Description | CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0. |
Risk And Classification
Problem Types: CWE-400
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ckeditor | Ckeditor5-engine | All | All | All | All |
| Application | Ckeditor | Ckeditor5-font | All | All | All | All |
| Application | Ckeditor | Ckeditor5-image | All | All | All | All |
| Application | Ckeditor | Ckeditor5-list | All | All | All | All |
| Application | Ckeditor | Ckeditor5-markdown-gfm | All | All | All | All |
| Application | Ckeditor | Ckeditor5-media-embed | All | All | All | All |
| Application | Ckeditor | Ckeditor5-paste-from-office | All | All | All | All |
| Application | Ckeditor | Ckeditor5-widget | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| @ckeditor/ckeditor5-markdown-gfm - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-paste-from-office - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-paste-from-office - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-widget - npm | www.npmjs.com | ||
| Regular expression Denial of Service in multiple packages · Advisory · ckeditor/ckeditor5 · GitHub | CONFIRM | github.com | |
| @ckeditor/ckeditor5-list - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-markdown-gfm - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-image - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-media-embed - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-engine - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-font - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-list - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-image - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-engine - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-widget - npm | MISC | www.npmjs.com | |
| @ckeditor/ckeditor5-media-embed - npm | www.npmjs.com | ||
| @ckeditor/ckeditor5-font - npm | MISC | www.npmjs.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982696 Nodejs (npm) Security Update for @ckeditor/ckeditor5-widget (GHSA-3rh3-wfr4-76mj)