An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW05NGMtMzdnNi1jamhj

Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.

Affected packages

The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:


A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.


The problem has been recognized and patched. The fix will be available in version 4.16.2.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.


The CKEditor 4 team would like to thank Mika Kulmala (kulmik) for recognizing and reporting this vulnerability.

Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Identifiers: GHSA-m94c-37g6-cjhc, CVE-2021-37695
References: Repository:
Blast Radius: 20.0

Affected Packages

Dependent packages: 26
Dependent repositories: 546
Downloads: 197,800 last month
Affected Version Ranges: < 4.16.2
Fixed in: 4.16.2
All affected versions: 4.13.0, 4.13.1, 4.14.0, 4.14.1, 4.15.0, 4.15.1, 4.16.0, 4.16.1
All unaffected versions: 4.16.2, 4.17.0, 4.17.1, 4.17.2, 4.18.0, 4.19.0, 4.19.1, 4.20.0, 4.20.1, 4.20.2, 4.21.0, 4.22.0, 4.22.1, 4.23.0, 4.24.0