CKeditor security issue--does it impact CiviCRM and what to do?
See https://github.com/civicrm/civicrm-core/pull/20428 which will be in 5.38. But my quick read of it is that the addons affected are not installed by default.