Prototype Pollution Vulnerability in CKEditor 5 by CKSource
CVE-2026-116688
8.1HIGH
What is CVE-2026-116688?
CKEditor 5 is a widely used modern JavaScript rich-text editor that suffers from a prototype pollution vulnerability due to a problematic es-toolkit version. This flaw is exploitable during the processing of style attributes in incoming editor content, potentially resulting in unauthorized JavaScript execution within the user's browser. The issue primarily affects CKEditor versions 45.0.0 to 47.7.4 and version 48.5.1. Users are urged to upgrade to the fixed versions 47.7.4 and 48.5.1 to mitigate this risk.
Affected Version(s)
ckeditor5 >= 45.0.0, < 47.7.4 < 45.0.0, 47.7.4
ckeditor5 >= 48.0.0, < 48.5.1 < 48.0.0, 48.5.1