What’s Vulnerable › Vulnerabilities

CVE-2026-116688: CKEditor: Cross-site scripting (XSS) in the engine package

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-27 · updated 2026-10-28
• Weakness: CWE-79

Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

Affected products

• ckeditor5: from 45.0.0, < 47.7.4; from 48.0.0, < 48.5.1

References

• https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
• https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
• https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
• https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp

Get alerted when CVE-2026-116688 or the next vulnerability affects your stack