Live › vulnerability › CVE-2026-116688
Go to dashboardCKEditor 5 uses a vulnerable es-toolkit version whose prototype pollution can be reached while the editor processes style attribute values. Crafted editor content can make the browser run unauthorized JavaScript.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 20:33 UTC. All times on this page are UTC.
Applications that embed CKEditor 5 in the 45.0.0 to 47.7.4 or 48.5.1 range and let users submit or load rich-text content that is then rendered in the editor. Exposure depends on users being able to supply content, so internal-only editors with trusted content carry less risk. Teams on other major versions outside the stated ranges can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ckeditor5 | npm | >= 45.0.0, < 47.7.4 | 47.7.4 |
| @ckeditor/ckeditor5-engine | npm | >= 45.0.0, < 47.7.4 | 47.7.4 |
| ckeditor5 | npm | >= 48.0.0, < 48.5.1 | 48.5.1 |
| @ckeditor/ckeditor5-engine | npm | >= 48.0.0, < 48.5.1 | 48.5.1 |
ckeditor5 package version in package.json or the lockfile; affected versions are 45.0.0 up to 47.7.4 and 48.5.1.es-toolkit is pinned in the lockfile to a vulnerable version.ckeditor5 to 47.7.4 or 48.5.1, matching your major line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values.
The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.
The problem has been recognized and patched. The fix will be available in version 48.5.1 (and above) and 47.7.4 (LTS).
Email us at [email protected] if you have any questions or comments about this advisory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116688")
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.