CVE:CVE-2021-21391
CNNVD:CNNVD-202104-2115
CKEditor是一套开源的、基于网页的文字编辑器。
CKEditor 5 存在资源管理错误漏洞，该漏洞源于一个正则表达式拒绝服务（ReDoS）漏洞。该漏洞允许滥用特定的正则表达式，这可能会导致性能显着下降，从而导致浏览器选项卡冻结。
solution:Upgrade ckeditor ckeditor5-engine to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-font to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-image to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-list to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-markdown-gfm to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-media-embed to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-paste-from-office to a higher version than 27.0.0,and avoid the version (,27.0.0); Upgrade ckeditor ckeditor5-widget to a higher version than 27.0.0,and avoid the version (,27.0.0)