UBUNTU-CVE-2026-116687: Low severity ubuntu/ckeditor vulnerability
Published Oct 27, 2026
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
Affected Software
21 affected components
ubuntu/ckeditor*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 47.7.4 - Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 48.5.1
Event History
Oct 27, 2026
CVE Published
via OSV·08:17 PM
Data Sourced
via OSV·08:17 PM
DescriptionSeverityAffected Software