{"id":"CVE-2026-116687","kind":"vulnerability","aliases":["CVE-2026-116687","GHSA-v6mg-96c6-gmpq"],"related":[],"title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.\n\nThis vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.","summary":"CKEditor 5 from 29.0.0 up to 47.7.4 and 48.5.1 can execute attacker-supplied JavaScript when General HTML Support is enabled and configured to allow object content. The script runs in a browser context isolated from the embedding application's origin.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ckeditor5","fixed":["47.7.4"],"affected":">= 29.0.0, < 47.7.4","ecosystem":"npm"},{"name":"@ckeditor/ckeditor5-engine","fixed":["47.7.4"],"affected":">= 29.0.0, < 47.7.4","ecosystem":"npm"},{"name":"ckeditor5","fixed":["48.5.1"],"affected":">= 48.0.0, < 48.5.1","ecosystem":"npm"},{"name":"@ckeditor/ckeditor5-engine","fixed":["48.5.1"],"affected":">= 48.0.0, < 48.5.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ckeditor5","cwe-79","javascript","package","rich-text-editor"],"not_affected_if":["default-config","ghs-object-not-allowed"],"how_to_check":"- Check the installed `ckeditor5` package version in `package.json` and lockfile against `47.7.4` / `48.5.1`\n- Search editor configuration for General HTML Support settings that allow `object` elements","fix":"- Upgrade `ckeditor5` to `47.7.4` or `48.5.1`, matching your major line","status":"open","published_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:35+00:00","updated_at":"2026-10-27T21:09:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T20:35:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `ckeditor5` to `47.7.4` or `48.5.1`, matching your major line","reach":"unknown","title":"CKEditor 5: crafted markup runs JavaScript in the editor's browser context","impact":"medium","summary":"CKEditor 5 from 29.0.0 up to 47.7.4 and 48.5.1 can execute attacker-supplied JavaScript when General HTML Support is enabled and configured to allow object content. The script runs in a browser context isolated from the embedding application's origin.","category":"package","nicknames":[],"who_cares":["javascript","ckeditor5","rich-text-editor"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker script runs in the editor's browser origin context","analyst_note":"Check the NVD entry and the CKEditor security advisory to confirm whether user interaction and authentication are required and which content is attacker-controlled.","how_to_check":"- Check the installed `ckeditor5` package version in `package.json` and lockfile against `47.7.4` / `48.5.1`\n- Search editor configuration for General HTML Support settings that allow `object` elements","needs_analyst":true,"not_affected_if":["default-config","ghs-object-not-allowed"],"who_is_affected":"Applications that embed CKEditor 5 from 29.0.0 onward with General HTML Support enabled and object content explicitly allowed. Editors using default configuration or without GHS object content are less exposed. Teams not using CKEditor 5 can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000621,"input_tokens":3374,"output_tokens":567,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116687':13A,21A '-2026':12A,20A '-79':28B '29.0.0':38B '47.7.4':41B,171C '48.5.1':43B,167C '5':36B,90C '96c6':17A 'advisori':191C 'affect':135C,149C 'allow':59B,110C,147C 'applic':73B,129C 'attack':47B 'attacker-suppli':46B 'avail':164C 'browser':67B,121C 'ckeditor':1A,35B,89C 'ckeditor/ckeditor5-engine':23A,25A 'ckeditor5':22A,24A,26B 'code':117C 'comment':188C 'configur':57B,108C,145C 'content':61B,151C 'context':68B,122C 'could':94C 'craft':100C 'cross':3A,79C 'cross-sit':2A,78C 'cve':11A,19A 'cwe':27B 'discov':86C 'editor':34B,132C 'email':176C 'embed':72B,130C 'enabl':55B,143C 'engin':9A,91C 'execut':45B,118C 'fix':161C 'general':51B,105C,139C 'ghsa':15A 'ghsa-v6mg-96c6-gmpq':14A 'gmpq':18A 'html':52B,106C,140C,150C 'impact':76C 'inform':175C 'insert':98C,111C 'instal':137C 'isol':69B,123C 'javascript':29B,49B,116C 'lead':113C 'lts':172C 'mailto':180C 'markup':101C 'object':60B,112C 'origin':75B,126C 'packag':10A,30B 'patch':152C,159C 'problem':154C 'question':186C 'recogn':157C 'rich':32B 'rich-text-editor':31B 'run':64B 'script':5A,63B,81C 'security@cksource.com':179C,181C 'site':4A,80C 'special':99C 'specif':104C 'suppli':48B 'support':53B,107C,141C 'text':33B 'trigger':96C 'unauthor':115C 'us':177C 'v6mg':16A 'version':166C 'vulner':83C,93C,134C 'xss':6A,82C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed CKEditor 5 from 29.0.0 onward with General HTML Support enabled and object content explicitly allowed. Editors using default configuration or without GHS object content are less exposed. Teams not using CKEditor 5 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116687","severity":null,"published_at":"2026-10-27T20:17:13+00:00","modified_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null},{"source":"ghsa","external_id":"GHSA-v6mg-96c6-gmpq","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq","severity":"low","published_at":"2026-10-27T21:05:13+00:00","modified_at":"2026-10-27T21:05:13+00:00","first_seen_at":"2026-10-27T21:09:20+00:00","fetched_at":"2026-10-27T21:09:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}