Low severity · published Oct 27, 2026
CVE-2026-116687
CKEditor: Cross-site scripting (XSS) in the engine package
New
3.1
CVSS
–
EPSS
No
On KEV
Description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
ckeditor5 · ckeditor
>= 29.0.0, < 47.7.4; >= 48.0.0, < 48.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116687
github.com
https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
github.com
https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
github.com
https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
github.com
https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
github.com
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
More from ckeditor5
8.1
CVE-2026-116688
CKEditor: Cross-site scripting (XSS) in the engine package
6.5
CVE-2021-21254
CKEditor 5 is an open source rich text editor framework with a modular architecture
6.1
CVE-2026-28343
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
6.1
CVE-2024-45613
CKEditor 5 is a JavaScript rich-text editor
5.4
CVE-2025-61261
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via…