CVE-2024-24816: CKEditor4 Preview Feature XSS Vulnerability

CVE-2024-24816 Overview

CKEditor4 is an open source WYSIWYG (what-you-see-is-what-you-get) HTML editor widely deployed in web applications for content authoring. CVE-2024-24816 is a cross-site scripting (XSS) vulnerability [CWE-79] in CKEditor4 versions prior to 4.24.0-lts. The flaw resides in sample files that use the preview feature. Integrators who ship these samples in production expose users to attacker-controlled JavaScript execution through the misconfigured preview functionality. The vendor released a fix in version 4.24.0-lts.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by abusing the vulnerable preview sample, enabling session hijacking, credential theft, and content manipulation across trusted web applications.

Affected Products

CKEditor4 versions prior to 4.24.0-lts
Applications shipping the vulnerable preview sample in production
Integrations relying on affected plugin samples such as autogrow

Discovery Timeline

2024-02-07 - CVE-2024-24816 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24816

Vulnerability Analysis

The vulnerability is a reflected/stored cross-site scripting issue [CWE-79] in CKEditor4 sample pages that invoke the preview feature. The preview sample renders editor content in a new window without adequately restricting active content, allowing attacker-supplied HTML to trigger inline JavaScript. When integrators deploy these samples to production paths, adversaries can craft editor content that runs script in the origin of the hosting site.

Exploitation requires user interaction, such as opening a preview link or loading crafted editor content. Successful attacks read cookies accessible to the origin, manipulate the DOM, perform actions on behalf of the authenticated user, and phish credentials via rendered UI. The impact is scoped to the browser context of the victim rather than the underlying host.

Root Cause

The issue stems from insufficient sanitization within the HTML parsing path and from sample pages that instantiate the editor with a permissive plugin set. In core/htmlparser.js, text nodes emitted during CDATA processing were forwarded through a path that could preserve script-bearing content. The upstream fix routes text through this.onText( text ) unconditionally, removing the CDATA branch that could carry unsanitized data.

Attack Vector

An attacker delivers crafted content to a page that instantiates the vulnerable preview sample, either by direct input, stored content, or a link containing weaponized markup. When the victim triggers the preview, the browser evaluates the embedded script in the site's origin.

javascript

// Patch excerpt from core/htmlparser.js (CKEditor4 4.24.0-lts)
if ( tagIndex > nextIndex ) {
    var text = html.substring( nextIndex, tagIndex );

-   if ( cdata )
-       cdata.push( text );
-   else
-       this.onText( text );
+   this.onText( text );
}

nextIndex = this._.htmlPartsRegex.lastIndex;

Source: GitHub Commit 8ed1a3c

The accompanying sample hardening restricts the plugin list to a known-safe set:

text

CKEDITOR.replace( 'editor1', {
    plugins: [
        'wysiwygarea', 'sourcearea', 'clipboard', 'basicstyles',
        'pastefromword', 'pastefromlibreoffice', 'pastefromgdocs',
        'undo', 'stylescombo', 'format', 'font', 'colorbutton',
        'removeformat', 'link', 'list', 'justify', 'blockquote',
        'table', 'tabletools', 'image'
    ],
    extraPlugins: 'autogrow',
    removePlugins: 'resize'
});

Source: GitHub Commit 8ed1a3c

Detection Methods for CVE-2024-24816

Indicators of Compromise

HTTP requests targeting CKEditor sample paths such as /ckeditor/samples/, /plugins/preview/, or /plugins/autogrow/samples/ in production traffic.
Editor payloads containing inline event handlers (onerror=, onload=) or <script> tags submitted to endpoints backed by CKEditor4.
Unexpected outbound requests from browsers to attacker-controlled hosts immediately after opening a preview window.

Detection Strategies

Inventory web assets for CKEditor4 versions older than 4.24.0-lts by scanning static files for ckeditor.js version strings.
Inspect web server logs for accesses to CKEditor4 sample directories, which should not be reachable in production.
Deploy web application firewall rules that flag editor submissions containing script tags or JavaScript URI schemes.

Monitoring Recommendations

Alert on browser telemetry indicating script execution originating from CKEditor sample pages or preview windows.
Correlate XSS indicators with authenticated session activity to identify potential session hijack attempts.
Monitor CDN and edge logs for repeated requests to preview endpoints from a single client with varying payloads.

How to Mitigate CVE-2024-24816

Immediate Actions Required

Upgrade CKEditor4 to version 4.24.0-lts or later across all deployments.
Remove CKEditor4 samples/ directories from production web roots, including plugins/preview/samples/ and plugins/autogrow/samples/.
Audit application code for direct references to vulnerable sample pages and replace them with hardened, integrator-owned implementations.

Patch Information

The vendor fix is available in CKEditor4 4.24.0-lts, delivered in commit 8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb. Details are documented in the GitHub Security Advisory GHSA-mw2c-vx6j-mg76 and the underlying GitHub Commit 8ed1a3c. Refer to the CKEditor Preview Addon page for supported configuration guidance.

Workarounds

Block public access to CKEditor4 samples/ paths at the reverse proxy or web server layer until an upgrade is completed.
Restrict the plugin list passed to CKEDITOR.replace() to a minimal, reviewed set that excludes unnecessary preview functionality.
Apply a strict Content Security Policy (CSP) that disallows inline scripts (script-src 'self') to reduce XSS impact.

bash

# Nginx example: deny access to CKEditor4 sample directories
location ~* /ckeditor/(samples|plugins/[^/]+/samples)/ {
    deny all;
    return 404;
}

# Recommended response header for pages embedding CKEditor4
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";