CVE-2026-116687: CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 48.5.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using CKEditor 5 versions from 29.0.0 through versions before 47.7.4 or 48.5.1 are affected only when General HTML Support is enabled and configured to allow object content.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to supply specially crafted markup that is processed by the editor. Successful exploitation can execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin.
What should teams do if they cannot patch immediately?
Disable General HTML Support or remove its configuration that permits object content until an upgrade is possible. The issue is fixed in CKEditor 5 versions 47.7.4 and 48.5.1.