ckeditor4 is vulnerable to cross-site scripting. An attacker is able to inject malicious script via the comment because --!>
is not handled.
ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#improvements-for-comments-in-html-parser
github.com/ckeditor/ckeditor4/commit/3e426ce34f7fc7bf784624358831ef9e189bb6ed
lists.debian.org/debian-lts-announce/2021/11/msg00007.html
lists.fedoraproject.org/archives/list/[email protected]/message/NYA354LJP47KCVJMTUO77ZCX3ZK42G3T/
lists.fedoraproject.org/archives/list/[email protected]/message/UVOYN2WKDPLKCNILIGEZM236ABQASLGW/
lists.fedoraproject.org/archives/list/[email protected]/message/WAGNWHFIQAVCP537KFFS2A2GDG66J7XD/
www.drupal.org/sa-core-2021-003