cyfenced.com →

[ CVE-2026-116687 · Published 27 Oct 2026 ]

CKEditor: Cross-site scripting (XSS) in the engine package

CVSS 3.1 EPSS <1%Fix available

[ Description ]Official description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.

[ Fixes ]Fixes and patches

  • ckeditor5 47.7.4Fixed version · GitHub Advisories · npm package ckeditor5: upgrade to 47.7.4 or later (affected >= 29.0.0, < 47.7.4)
  • @ckeditor/ckeditor5-engine 47.7.4Fixed version · GitHub Advisories · npm package @ckeditor/ckeditor5-engine: upgrade to 47.7.4 or later (affected >= 29.0.0, < 47.7.4)
  • ckeditor5 48.5.1Fixed version · GitHub Advisories · npm package ckeditor5: upgrade to 48.5.1 or later (affected >= 48.0.0, < 48.5.1)
  • @ckeditor/ckeditor5-engine 48.5.1Fixed version · GitHub Advisories · npm package @ckeditor/ckeditor5-engine: upgrade to 48.5.1 or later (affected >= 48.0.0, < 48.5.1)

[ Packages ]Affected open-source packages

[ References ]References