Cross Site Request Forgery in kindeditor

HIGH 8.8CVE-2021-42228 · GHSA-3ww4-cp53-6g2x · Published 14/10/2021 · updated 17/06/2026

In short

CVE-2021-42228 is a HIGH (CVSS 8.8) vulnerability affecting kindeditor (kindsoft), kindeditor.
Chance of exploitation in the next 30 days (EPSS): 0.99%, higher than 62.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kindeditor kindsoft	`≥ 4.1, ≤ 4.1.12`	No fix yet
kindeditor npm	`≤ 4.1.12`	No fix yet

Description

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.

NVD description

A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.

References

nvd.nist.gov/vuln/detail/CVE-2021-42228 · ADVISORY
kindsoft/kindeditor · WEB
kindsoft/kindeditor · PACKAGE

More vulnerabilities in kindeditor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

kindeditor

kindsoft

≥ 4.1, ≤ 4.1.12

No fix yet

kindeditor

npm

≤ 4.1.12

No fix yet

Description

NVD description

A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.

More vulnerabilities in kindeditor

See all →