# CVE-2022-24729: ckeditor4 — Fixed in 4.18.0 📦 📦 npm Not in CISA KEV MEDIUM severity # CVE-2022-24729 — ckeditor4 MEDIUM [Fix: ckeditor/ckeditor4@d158413](https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949) CVE-2022-24729 is a medium-severity (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in ckeditor4. A fix is available for ckeditor4 — see the affected versions and patch details below. Regular expression Denial of Service in dialog plugin Also known asBIT-drupal-2022-24728BIT-drupal-2022-24729[CVE-2022-24728](/vulnerability/CVE-2022-24728)DRUPAL-CORE-2022-005[GHSA-4fc4-4p5g-6w89](/vulnerability/GHSA-4fc4-4p5g-6w89)[GHSA-f6rf-9m92-x2hh](/vulnerability/GHSA-f6rf-9m92-x2hh) Published Mar 16, 2022 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 2.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs85th percentile — riskier than 85% of all scored CVEsHighest risk 0.34%1.23%2.11%2.99%0.8%2.5%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 27other npm packages depend on this — each one inherits the vulnerability until it's patched upstream `ckeditor4`npm 65Kdownloads / week ## Description #### Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. #### Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0. #### Patches The problem has been recognized and patched. The fix will be available in version 4.18.0. #### For more information Email us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory. #### Acknowledgements The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse ([@kevinbackhouse](https://github.com/kevinbackhouse)) for recognizing and reporting this vulnerability. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 📦npm `ckeditor4` all versions 4.18.0`npm install ckeditor4@4.18.0` ## Affected Products 9 products · 19 configurations Application `ckeditor`ckeditor ≥ 4.0 && < 4.18.0 range Application `drupal`drupal ≥ 9.3.0 && < 9.3.8 range OS `fedora`fedoraproject 2 versions 3637 Application `application express`oracle < 22.1.1 range Application `commerce merchandising`oracle 1 version 11.3.2 Application `financial services analytical applications infrastructure`oracle ≥ 8.0.7.0.0 && ≤ 8.1.0.0.0 3 versions 8.1.1.08.1.2.08.1.2.1 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ckeditor4, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update ckeditor4 to 4.18.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-24729 is resolved across your whole dependency graph. 3. ### Workarounds Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. ## Frequently Asked Questions \### Affected packages The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. ### Impact A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0. ### Patches The problem has been recognized and patched. The fix will be available in version 4.18.0. ### For more information Email us at security@cksource.com O3 Security · Impact-Aware SCA ### Is CVE-2022-24729 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)