UBUNTU-CVE-2026-116688: High severity ubuntu/ckeditor vulnerability
Published Oct 27, 2026
·Updated
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
Affected Software
21 affected components
ubuntu/ckeditor*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ckeditor3*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
ubuntu/ckeditor*
ubuntu/ldap-account-manager*
ubuntu/request-tracker4*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 47.7.4 - Upgrade
Upgrade
CKEditor 5to a version that resolves this vulnerability.Fixed in 48.5.1
Event History
Oct 27, 2026
CVE Published
via OSV·08:17 PM
Data Sourced
via OSV·08:17 PM
DescriptionSeverityAffected Software