concretecms: This CKEditor 4.22.1 (Standard) version is not secure. Consider upgrading to the latest one, 4.24.0-lts.

I wanted to make sure we got all the facts. Here is our official response:

https://forums.concretecms.org/t/ckeditor-4-22-1-and-concrete-cms-security-updates/6941

In the meantime, you can fix this on your sites by editing application/config/generated_overrides/site.php, and adding the following configuration code:

return [
    'sites' => [
        'default' => [
            // Extra content snipped for example
            'editor' => [
                'ckeditor4' => [
                    'custom_config_options' => [
                        'versionCheck' => false,
                    ]
                ]
            ]
        ],
    ],
];

We will add this asap to the next release. To be clear, it is CKEditor’s own license that prevents from updating to CKEditor 5.

This is such gross behavior. Absolutely horrendous.

We have to add versionCheck: false to the ckeditor configuration - see https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-versionCheck

+1 but also seeing this in 8.5.14