CVE-2026-116687
- Source
- https://cve.org/CVERecord?id=CVE-2026-116687
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116687.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-116687
- Aliases
- Downstream
- Published
- 2026-10-27T19:33:11Z
- Modified
- 2026-10-28T10:45:21Z
- Severity
-
- 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- CKEditor: Cross-site scripting (XSS) in the engine package
- Details
-
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116687.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116687.json
- https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
- https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
- https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
- https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
- https://nvd.nist.gov/vuln/detail/CVE-2026-116687
Affected packages
Git / github.com/ckeditor/ckeditor5
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ckeditor/ckeditor5
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "29.0.0" }, { "fixed": "47.7.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "48.0.0" }, { "fixed": "48.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "4d9c5bb34f63cd956d15ccafbe584e14280c86a0" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a750e38635db6a18c5b11599c09f4fd702850423" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v47.7.4", "range": [ { "fixed": "909a99ede76b640b7b4780fadaff900b8a81a27e" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v48.5.1", "range": [ { "fixed": "1867f7a292a98e5740873b5f42f205d7414a0c5a" } ], "source": "REFERENCES_TAG" } ] }