TI-2026-22628 Aliases CVE-2026-28343 GHSA-jrqm-vmqc-gm93

CKEditor: Cross-site scripting (XSS) in the HTML Support package

LOW 28CWE-79Published 2026-03-05 · Updated 2026-03-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00319 25th percentileScored 2026-11-07

Fix Fixed ckeditor5 (ckeditor): 47.6.0@ckeditor/ckeditor5-html-support (npm): 47.6.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ckeditor	ckeditor5	29.0.0 to before 47.6.0	47.6.0	Patch available	CNA
—	@ckeditor/ckeditor5-html-support (npm)	29.0.0 to before 47.6.0	47.6.0	Patch available	GHSA-jrqm-vmqc-gm93
—	ckeditor5 (npm)	29.0.0 to before 47.6.0	47.6.0	Patch available	GHSA-jrqm-vmqc-gm93

ckeditor5 Vendorckeditor Affected 29.0.0 to before 47.6.0 Fixed in 47.6.0 Patch available CNA
@ckeditor/ckeditor5-html-support (npm) Vendor— Affected 29.0.0 to before 47.6.0 Fixed in 47.6.0 Patch available GHSA-jrqm-vmqc-gm93
ckeditor5 (npm) Vendor— Affected 29.0.0 to before 47.6.0 Fixed in 47.6.0 Patch available GHSA-jrqm-vmqc-gm93

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ckeditor:ckeditor5::::::::	before 47.6.0	Vulnerable	ckeditor

cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:* Versions before 47.6.0 Vulnerable ·ckeditor

Remediation

Fix · CNA ckeditor5 (ckeditor) Fixed in 47.6.0
Fix · GHSA-jrqm-vmqc-gm93 @ckeditor/ckeditor5-html-support (npm) Fixed in 47.6.0 Advisory →
Fix · GHSA-jrqm-vmqc-gm93 ckeditor5 (npm) Fixed in 47.6.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-28343
2026-10-03 Alias added: GHSA-jrqm-vmqc-gm93

References

Advisory 2

Other 3

TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
TI-2021-04357 Regular expression Denial of Service in Markdown plugin CVSS 3.1MEDIUM 6.5
TI-2024-30632 CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences