Cross-Site Scripting in CKEditor 5 by CKSource
CVE-2026-116687
3.1LOW
What is CVE-2026-116687?
CKEditor 5, a widely used JavaScript rich-text editor, is susceptible to cross-site scripting when General HTML Support is activated and set to permit object content. Under these configurations, maliciously crafted markup can execute unauthorized JavaScript in the context of the user's browser. This vulnerability can allow attackers to manipulate web applications leveraging the editor, posing significant security risks. Users are urged to upgrade to the fixed versions, 47.7.4 and 48.5.1, to mitigate this threat.
Affected Version(s)
ckeditor5 >= 29.0.0, < 47.7.4 < 29.0.0, 47.7.4
ckeditor5 >= 48.0.0, < 48.5.1 < 48.0.0, 48.5.1