@ckeditor/ckeditor5-engine vulnerabilities
CVEs whose affected-version data names the @ckeditor/ckeditor5-engine package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116687Low· 3.1CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor: Cross-site scripting (XSS) in the engine package
▾ Sunlitckeditor5 · ckeditor5via GHSA
CVE-2026-116688High· 8.1CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor: Cross-site scripting (XSS) in the engine package
▾ Twilightckeditor5 · ckeditor5via GHSA