CVE-2021-21254 Regular expression Denial of Service in Markdown plugin
An attacker can cause a browser tab freeze in CKEditor 5 Markdown plugin via a regex denial of service attack.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21254?
CVE-2021-21254 is a medium-severity denial of service vulnerability in ckeditor5, published on 29 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.
Weakness: CWE-400
Which versions are affected by CVE-2021-21254?
2 open source packages ship an affected version, including @ckeditor/ckeditor5-markdown-gfm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@ckeditor/ckeditor5-markdown-gfm npm | All versions | 25.0.0 |
@ckeditor/ckeditor5-markdown-gfm npm | All versions | 25.0.0 |
Products include Ckeditor Ckeditor5.
How do I fix CVE-2021-21254?
Upgrade @ckeditor/ckeditor5-markdown-gfm to 25.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21254 being exploited?
There is no known exploitation of CVE-2021-21254 in the wild and no public exploit code.
Other vulnerabilities in ckeditor5
Sources
Also known as GHSA-hgmg-hhc8-g5wr.