PT-2021-14364 · Ckeditor · Ckeditor 5 Markdown Plugin

Alvaro Muñoz + 1 · Published 2021-01-29 · Updated 2022-08-09 · CVE-2021-21254

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: CKEditor 5 Markdown plugin versions prior to 25.0.0

Description: The CKEditor 5 Markdown plugin has a regex denial of service (ReDoS) vulnerability. This vulnerability allows the abuse of link recognition regular expressions, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0.

Recommendations: For CKEditor 5 Markdown plugin versions prior to 25.0.0, upgrade to version 25.0.0 to resolve the issue. As a temporary workaround, consider disabling the Markdown plugin until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-21254

GHSA-HGMG-HHC8-G5WR

Affected Products

Ckeditor 5 Markdown Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-21254 · Security Note
• https://osv.dev/vulnerability/GHSA-hgmg-hhc8-g5wr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21254 · Vendor Advisory
• https://github.com/ckeditor/ckeditor5/releases/tag/v25.0.0 · Note
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-hgmg-hhc8-g5wr · Note
• https://github.com/ckeditor/ckeditor5 · Note
• https://npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm · Note
• https://t.me/cibsecurity/22873 · Telegram Post
• https://npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm · Note