{"id":"CVE-2026-116687","aliases":["GHSA-v6mg-96c6-gmpq"],"title":"CKEditor: Cross-site scripting (XSS) in the engine package","summary":"CKEditor: Cross-site scripting (XSS) in the engine package","severity":"low","cvss":3.1,"cwe":["CWE-79"],"vendor":"ckeditor5","product":"ckeditor5","ecosystem":"npm","affected":["ckeditor5 >= 29.0.0, < 47.7.4","@ckeditor/ckeditor5-engine >= 29.0.0, < 47.7.4","ckeditor5 >= 48.0.0, < 48.5.1","@ckeditor/ckeditor5-engine >= 48.0.0, < 48.5.1"],"patched":["ckeditor5 47.7.4","@ckeditor/ckeditor5-engine 47.7.4","ckeditor5 48.5.1","@ckeditor/ckeditor5-engine 48.5.1"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T21:05:13Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq","references":[{"url":"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq"},{"url":"https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0"},{"url":"https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423"},{"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4"},{"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1"},{"url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"}],"tags":["ghsa","npm","cve.org"],"ingestedAt":"2026-10-27T19:54:27.803Z","slug":"CVE-2026-116687","body":"## Overview\n\n### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.\n\nThis vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.\n\n## Affected packages\n\n- `ckeditor5 >= 29.0.0, < 47.7.4`\n- `@ckeditor/ckeditor5-engine >= 29.0.0, < 47.7.4`\n- `ckeditor5 >= 48.0.0, < 48.5.1`\n- `@ckeditor/ckeditor5-engine >= 48.0.0, < 48.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ckeditor5 47.7.4`\n- `@ckeditor/ckeditor5-engine 47.7.4`\n- `ckeditor5 48.5.1`\n- `@ckeditor/ckeditor5-engine 48.5.1`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}