GHSA-v6mg-96c6-gmpq: XSS

Q: Which deployments are affected?

Only CKEditor 5 installations with General HTML Support enabled and configured to allow the affected HTML content are affected. Installations without that configuration are not described as affected.

Q: What does an attacker need to exploit this issue?

An attacker needs the ability to insert specially crafted markup that is permitted by the relevant General HTML Support configuration. Successful exploitation can execute unauthorized JavaScript in a browser context isolated from the embedding application's origin.

Q: Which versions contain the fix?

The fix is available in version 48.5.1 and later, and in the 47.7.4 LTS release.

Published Oct 27, 2026

Updated

Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.

Patches The problem has been recognized and patched. The fix will be available in version 48.5.1 (and above) and 47.7.4 (LTS).

For more information Email us at security@cksource.com if you have any questions or comments about this advisory.

Affected Software

4 affected componentsFixes available

npm/@ckeditor/ckeditor5-engine>=48.0.0<48.5.1

48.5.1

npm/ckeditor5>=48.0.0<48.5.1

48.5.1

npm/@ckeditor/ckeditor5-engine>=29.0.0<47.7.4

47.7.4

npm/ckeditor5>=29.0.0<47.7.4

47.7.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@ckeditor/ckeditor5-engine to a version that resolves this vulnerability.
Fixed in 48.5.1
Upgrade
Upgrade npm/ckeditor5 to a version that resolves this vulnerability.
Fixed in 48.5.1
Upgrade
Upgrade npm/@ckeditor/ckeditor5-engine to a version that resolves this vulnerability.
Fixed in 47.7.4
Upgrade
Upgrade npm/ckeditor5 to a version that resolves this vulnerability.
Fixed in 47.7.4
Upgrade
Upgrade CKEditor 5 engine to a version that resolves this vulnerability.
Fixed in 48.5.1

Event History

Oct 27, 2026

Advisory Published

via GitHub·09:05 PM

Data Sourced

via GitHub·09:05 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

Only CKEditor 5 installations with General HTML Support enabled and configured to allow the affected HTML content are affected. Installations without that configuration are not described as affected.

What does an attacker need to exploit this issue?