CVE-2022-24729

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has released [a security update that impacts Drupal](https://ckeditor.com/blog/ckeditor-4.18.0-browser-bugfix-and-security-patches/). Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's security advisories: * [CVE-2022-24728: HTML processing vulnerability allowing to execute JavaScript code](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89) * [CVE-2022-24729: Regular expression Denial of Service in dialog plugin](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh) This advisory is not covered by [Drupal Steward](/steward).

CKEditor4 es un editor HTML de código abierto "lo que visualizas es lo que obtienes". CKEditor4 versiones anteriores a 4.18.0, contiene una vulnerabilidad en el plugin "dialog". La vulnerabilidad permite abusar de una expresión regular del validador de entrada de diálogos, lo que puede causar una importante caída de rendimiento resultando en una congelación de la pestaña del navegador. Se presenta un parche disponible en versión 4.18.0. Actualmente no se conocen medidas de mitigación