Cross-Site Scripting Vulnerability in CKEditor 5 by CKSource
CVE-2026-28343

6.4MEDIUM

Key Information:

Vendor: Ckeditor
Status: Ckeditor5
Vendor: CVE Published:; 5 March 2026

What is CVE-2026-28343?

CKEditor 5, a popular modern JavaScript rich-text editor, has a cross-site scripting (XSS) vulnerability impacting versions before 47.6.0. This flaw arises within the General HTML Support feature and can be exploited by inserting specially crafted markup, which may lead to unauthorized execution of JavaScript code. The vulnerability primarily affects instances configured with unsafe General HTML Support settings. Users are advised to upgrade to version 47.6.0 or later, where this issue has been addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch