High severity · published Oct 27, 2026
CVE-2026-116688
CKEditor: Cross-site scripting (XSS) in the engine package
New
8.1
CVSS
–
EPSS
No
On KEV
Description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
ckeditor5 · ckeditor
>= 45.0.0, < 47.7.4; >= 48.0.0, < 48.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116688
github.com
https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
github.com
https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
github.com
https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
github.com
https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
github.com
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp
More from ckeditor5
6.5
CVE-2021-21254
CKEditor 5 is an open source rich text editor framework with a modular architecture
6.1
CVE-2026-28343
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
6.1
CVE-2024-45613
CKEditor 5 is a JavaScript rich-text editor
5.4
CVE-2025-61261
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via…
4.7
CVE-2022-31175
Cross-site scripting caused by the editor instance destroying process in ckeditor5