CVE-2026-116687GHSA-v6mg-96c6-gmpq

ckeditor5: CKEditor: Cross-site scripting (XSS) in the engine package

ckeditor ckeditor5npmLibraries & packages

Open in Threatline Record JSON

CVSS

3.1Low

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in47.7.4Also 48.5.1GitHub

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

47.7.4ckeditor5, npmGitHubnpm install ckeditor5@47.7.4
47.7.4@ckeditor/ckeditor5-engine, npmGitHubnpm install @ckeditor/ckeditor5-engine@47.7.4
48.5.1ckeditor5, npmGitHubnpm install ckeditor5@48.5.1
48.5.1@ckeditor/ckeditor5-engine, npmGitHubnpm install @ckeditor/ckeditor5-engine@48.5.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-116687 CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when GenerTelegram: CVE Notify, 27 Oct 2026

Description

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.

Patches

The problem has been recognized and patched. The fix will be available in version 48.5.1 (and above) and 47.7.4 (LTS).

For more information

Email us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.

Text from GitHub Advisory Database

Affected versions 10

ckeditor5, npm>= 29.0.0, < 47.7.4GitHub
@ckeditor/ckeditor5-engine, npm>= 29.0.0, < 47.7.4GitHub
ckeditor5, npm>= 48.0.0, < 48.5.1GitHub
@ckeditor/ckeditor5-engine, npm>= 48.0.0, < 48.5.1GitHub
ckeditor5affected: >= 29.0.0, < 47.7.4CVE List
ckeditor5affected: >= 48.0.0, < 48.5.1CVE List
ckeditor5, npmfrom 29.0.0, fixed in 47.7.4OSV
@ckeditor/ckeditor5-engine, npmfrom 29.0.0, fixed in 47.7.4OSV
ckeditor5, npmfrom 48.0.0, fixed in 48.5.1OSV
@ckeditor/ckeditor5-engine, npmfrom 48.0.0, fixed in 48.5.1OSV