CVE-2026-116688: CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKEditor 5 engine packageto a version that resolves this vulnerability.Fixed in 47.7.4 - Upgrade
Upgrade
CKEditor 5 engine packageto a version that resolves this vulnerability.Fixed in 48.5.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
They need low-level privileges and must be able to supply crafted editor content containing malicious style attribute values that CKEditor processes. No user interaction is required after the crafted content is processed.
Which deployments should be reviewed first?
Review CKEditor 5 deployments using versions from 45.0.0 up to the fixed releases. The issue affects the engine package when it processes incoming style attribute values.
What is the available remediation?
Update to CKEditor 5 version 47.7.4 or 48.5.1, which contain the fix. These releases address the vulnerable es-toolkit prototype-pollution behavior.
How can we determine whether we may be affected?
Check the deployed CKEditor 5 version and whether the application accepts or processes editor content with style attributes. Deployments running versions before the listed fixed releases should be treated as requiring remediation.