CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp

Configurations

No configuration.

History

27 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-27 20:17

Updated : 2026-11-02 20:17

NVD link : CVE-2026-116688

Mitre link : CVE-2026-116688

CVE.ORG link : CVE-2026-116688

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-116688", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116688", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T19:40:38.974615Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ckeditor", "product": "ckeditor5", "versions": [{"status": "affected", "version": ">= 45.0.0, < 47.7.4"}, {"status": "affected", "version": ">= 48.0.0, < 48.5.1"}]}]}], "published": "2026-10-27T20:17:14.037", "references": [{"url": "https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0", "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423", "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1."}], "lastModified": "2026-11-02T20:17:33.097", "sourceIdentifier": "security-advisories@github.com"}