Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.

Affected packages

The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:

• Fake Objects
• Link
• Flash
• Iframe
• Forms
• Page Break

Impact

A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

Patches

The problem has been recognized and patched. The fix will be available in version 4.16.2.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Acknowledgements

The CKEditor 4 team would like to thank Mika Kulmala (kulmik) for recognizing and reporting this vulnerability.