Read the docs
TI-2026-81521 Aliases CVE-2026-116688GHSA-rh54-vffm-5fvp

Cross-site scripting in CKEditor 5 engine package

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The ckeditor5 and @ckeditor/ckeditor5-engine npm packages from 45.0.0 before 47.7.4 and from 48.0.0 before 48.5.1 are affected. The engine uses a vulnerable es-toolkit version whose prototype pollution can be reached while CKEditor processes style attribute values (CWE-79). A remote attacker with low privileges can use crafted editor content to run JavaScript in a victim's browser.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Fixed ckeditor5 (ckeditor): 47.7.4, 48.5.1ckeditor5 (npm): 47.7.4, 48.5.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ckeditorckeditor545.0.0 to before 47.7.4; 48.0.0 to before 48.5.147.7.4, 48.5.1Patch availableCNA
—ckeditor5 (npm)45.0.0 to before 47.7.447.7.4Patch availableGHSA-rh54-vffm-5fvp
—@ckeditor/ckeditor5-engine (npm)45.0.0 to before 47.7.447.7.4Patch availableGHSA-rh54-vffm-5fvp
—ckeditor5 (npm)48.0.0 to before 48.5.148.5.1Patch availableGHSA-rh54-vffm-5fvp
—@ckeditor/ckeditor5-engine (npm)48.0.0 to before 48.5.148.5.1Patch availableGHSA-rh54-vffm-5fvp
  • ckeditor5 Vendorckeditor Affected 45.0.0 to before 47.7.4; 48.0.0 to before 48.5.1 Fixed in 47.7.4, 48.5.1 Patch available CNA
  • ckeditor5 (npm) Vendor— Affected 45.0.0 to before 47.7.4 Fixed in 47.7.4 Patch available GHSA-rh54-vffm-5fvp
  • @ckeditor/ckeditor5-engine (npm) Vendor— Affected 45.0.0 to before 47.7.4 Fixed in 47.7.4 Patch available GHSA-rh54-vffm-5fvp
  • ckeditor5 (npm) Vendor— Affected 48.0.0 to before 48.5.1 Fixed in 48.5.1 Patch available GHSA-rh54-vffm-5fvp
  • @ckeditor/ckeditor5-engine (npm) Vendor— Affected 48.0.0 to before 48.5.1 Fixed in 48.5.1 Patch available GHSA-rh54-vffm-5fvp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*——ckeditor
  • cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:* Versions — — ·ckeditor

Remediation

Upgrade ckeditor5 and @ckeditor/ckeditor5-engine to 47.7.4 for the 45.0.0 before 47.7.4 range and to 48.5.1 for the 48.0.0 before 48.5.1 range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA ckeditor5 (ckeditor) Fixed in 47.7.4, 48.5.1
  • Fix · GHSA-rh54-vffm-5fvp ckeditor5 (npm) Fixed in 47.7.4 Advisory →
  • Fix · GHSA-rh54-vffm-5fvp @ckeditor/ckeditor5-engine (npm) Fixed in 47.7.4 Advisory →
  • Fix · GHSA-rh54-vffm-5fvp ckeditor5 (npm) Fixed in 48.5.1 Advisory →
  • Fix · GHSA-rh54-vffm-5fvp @ckeditor/ckeditor5-engine (npm) Fixed in 48.5.1 Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116688
  2. 2026-10-27 Alias added: GHSA-rh54-vffm-5fvp
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-02 CISA SSVC decision points changed

References

Other 6

  • TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
  • TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
  • TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
  • TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences