CVE-2021-26271: 
JavaScript vulnerability analysis and mitigation

A ReDoS-type attack vulnerability was discovered in CKEditor 4 before version 4.16, identified as CVE-2021-26271. The vulnerability was found in the Styles input functionality of specific dialogs (in the Advanced Tab for Dialogs plugin), where a victim could be persuaded to paste crafted text, potentially leading to a denial of service attack (CKEditor Blog, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The attack vector is network-based, with low attack complexity, requiring no privileges but does need user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but high impact on availability (NVD).

If successfully exploited, the vulnerability could lead to a denial of service condition through a ReDoS (Regular Expression Denial of Service) attack when a user pastes specifically crafted text into the Styles input of specific dialogs (NVD).

The vulnerability requires user interaction, specifically requiring the victim to paste crafted text into the Styles input of specific dialogs in the Advanced Tab for Dialogs plugin. The attack can be executed over a network without requiring authentication (NVD).

The vulnerability was fixed in CKEditor version 4.16. Users should upgrade to this version or later to mitigate the risk. No other workarounds were officially documented (CKEditor Blog).