CVE-2026-116687
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In CKEditor 5 from 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
Risk Assessment
An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to session data theft or other attacks within the application context. The risk affects applications using CKEditor 5 with General HTML Support enabled.
Recommendation
Update CKEditor 5 to version 47.7.4 or 48.5.1. If possible, disable or restrict General HTML Support for object content until the update is applied.
Other vulnerabilities in CKEditor 5
See all- CVE-2023-31541Critical
The CKEditor v1.2.3 plugin for Redmine has an unrestricted file upload vulnerability in the 'Browse and upload images' feature, allowing arbitrary files to be uploaded to the server.
- CVE-2020-9281Medium
CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).
- CVE-2026-116688High
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
- CVE-2021-26272Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
- CVE-2021-26271Medium
In CKEditor 4 before 4.16, it was possible to execute a ReDoS-type attack by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
- CVE-2020-27193Medium
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of the editor inputs.
Original NVD description (English source)
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS