CVE-2026-116688highCWE-79

CVE-2026-116688: fallo de gravedad alta en ckeditor5

CKEditor: Cross-site scripting (XSS) in the engine package

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ckeditor5+ Monitorear ckeditor5

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.5%
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
ckeditor · ckeditor5
CVEs relacionadas — ckeditor5

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-21254MEDIUMRegular expression Denial of Service in Markdown pluginEPSS 1.8%CVE-2021-21391MEDIUMRegular expression Denial of Service in multiple packagesEPSS 1.7%CVE-2022-31175MEDIUMCross-site scripting caused by the editor instance destroying process in ckeditor5EPSS 0.9%CVE-2025-25299LOWCross-site scripting (XSS) in the real-time collaboration packageEPSS 0.6%CVE-2024-45613MEDIUMCKEditor 5 has Cross-site Scripting vulnerability in the clipboard packageEPSS 0.5%CVE-2025-58064LOWCKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packageEPSS 0.4%