CVE-2026-116687lowCWE-79

CVE-2026-116687: low-severity vulnerability in ckeditor5

CKEditor: Cross-site scripting (XSS) in the engine package

Published · Updated

Follow this CVE+ Monitor ckeditor5+ Monitor ckeditor5

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 0.3%
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
ckeditor · ckeditor5
Related CVEs — ckeditor5

In the same product, most dangerous first.

CVE-2021-21254MEDIUMRegular expression Denial of Service in Markdown pluginEPSS 1.8%CVE-2021-21391MEDIUMRegular expression Denial of Service in multiple packagesEPSS 1.7%CVE-2022-31175MEDIUMCross-site scripting caused by the editor instance destroying process in ckeditor5EPSS 0.9%CVE-2025-25299LOWCross-site scripting (XSS) in the real-time collaboration packageEPSS 0.6%CVE-2024-45613MEDIUMCKEditor 5 has Cross-site Scripting vulnerability in the clipboard packageEPSS 0.5%CVE-2026-116688HIGHCKEditor: Cross-site scripting (XSS) in the engine packageEPSS 0.5%