p PatchFirst

CVE-2026-116687

CVE-2026-116687 · CKEditor: Cross-site scripting (XSS) in the engine package

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.

CVSS 3.1 · Low · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ckeditor5

    Versions
    • >= 29.0.0, < 47.7.4: Affected
    • >= 48.0.0, < 48.5.1: Affected

    No fix published

  • ckeditor5 npm

    Affected ranges
    • SEMVER: ≥ 29.0.0, < 47.7.4

    Update to 47.7.4

  • @ckeditor/ckeditor5-engine npm

    Affected ranges
    • SEMVER: ≥ 29.0.0, < 47.7.4

    Update to 47.7.4

  • ckeditor5 npm

    Affected ranges
    • SEMVER: ≥ 48.0.0, < 48.5.1

    Update to 48.5.1

  • @ckeditor/ckeditor5-engine npm

    Affected ranges
    • SEMVER: ≥ 48.0.0, < 48.5.1

    Update to 48.5.1

Original sources

Check your server →