CVE-2024-24815 Overview
CVE-2024-24815 is a cross-site scripting (XSS) vulnerability [CWE-79] in the core HTML parsing module of CKEditor4 prior to version 4.24.0-lts. The flaw affects editor instances that enable full-page editing mode or permit CDATA elements in the Advanced Content Filtering (ACF) configuration, which defaults to script and style elements. Attackers can inject malformed HTML content that bypasses ACF, resulting in JavaScript execution in the victim's browser. The vendor fixed the issue in version 4.24.0-lts.
Critical Impact
An attacker who supplies malformed CDATA content to a vulnerable CKEditor4 instance can bypass Advanced Content Filtering and execute arbitrary JavaScript in the context of the target application.
Affected Products
- CKEditor4 versions prior to 4.24.0-lts
- Applications that enable CKEditor4 full-page editing mode
- Applications that permit CDATA elements in ACF configuration (default script and style)
Discovery Timeline
- 2024-02-07 - CVE-2024-24815 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24815
Vulnerability Analysis
The vulnerability resides in the CKEditor4 HTML parser (core/htmlparser.js), which handles content marked as CDATA (character data). CDATA sections are treated as raw text and are not subjected to the same filtering as regular HTML. CKEditor4 uses this behavior for elements such as script and style, which contain code rather than markup.
Because the parser's CDATA detection logic can be tricked by malformed HTML, attacker-controlled markup can be routed into the CDATA branch and reinserted into the document without ACF sanitization. The result is stored or reflected script execution in the browser of any user who loads or edits the affected content.
Exploitation requires user interaction, such as loading attacker-supplied content into the editor. The scope changes because injected JavaScript executes in the context of the hosting application, which enables session theft, request forgery, and content manipulation.
Root Cause
The parser pushed intermediate text into a cdata buffer whenever a CDATA context was active, and then emitted that buffer as raw output. Faulty CDATA state tracking allowed an attacker to prepare input where the parser believed it was still inside a CDATA element while the browser did not, causing markup that ACF would normally strip to be delivered verbatim to the DOM.
Attack Vector
The attack is network-reachable and requires user interaction. A remote attacker submits crafted HTML containing malformed CDATA constructs to any application field that renders through CKEditor4. When a victim views or edits the content, the injected <script> payload executes with the permissions of the application origin.
// Security patch in core/htmlparser.js
// Source: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb
if ( tagIndex > nextIndex ) {
var text = html.substring( nextIndex, tagIndex );
- if ( cdata )
- cdata.push( text );
- else
- this.onText( text );
+ this.onText( text );
}
nextIndex = this._.htmlPartsRegex.lastIndex;
The patch removes the branch that redirected intermediate text into the cdata buffer, forcing all text through onText() where standard filtering applies.
Detection Methods for CVE-2024-24815
Indicators of Compromise
- Stored HTML content containing malformed or nested <script>, <style>, or CDATA sequences submitted through CKEditor4-backed forms.
- Outbound requests from user browsers to attacker-controlled hosts shortly after rendering editor content.
- Unexpected inline event handlers (onerror, onload, onmouseover) inside fields expected to be plain rich text.
Detection Strategies
- Inventory web applications that embed CKEditor4 and identify versions older than 4.24.0-lts, especially those with fullPage mode or CDATA entries in ACF allowedContent.
- Scan stored records in content databases for HTML patterns that combine <