GHSA-v6mg-96c6-gmpq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v6mg-96c6-gmpq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v6mg-96c6-gmpq/GHSA-v6mg-96c6-gmpq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v6mg-96c6-gmpq
- Aliases
-
- CVE-2026-116687
- Published
- 2026-10-27T21:05:13Z
- Modified
- 2026-10-27T21:15:03Z
- Severity
-
- 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- CKEditor: Cross-site scripting (XSS) in the engine package
- Details
-
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.
Patches
The problem has been recognized and patched. The fix will be available in version
48.5.1(and above) and47.7.4(LTS).For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-10-27T21:05:13Z", "nvd_published_at": null, "severity": "LOW" }- References
-
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
- https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
- https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
- https://github.com/ckeditor/ckeditor5
- https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
- https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
Affected packages
npm / ckeditor5
Package
- Name
- ckeditor5
- View open source insights on deps.dev
- Purl
- pkg:npm/ckeditor5
npm / @ckeditor/ckeditor5-engine
Package
- Name
- @ckeditor/ckeditor5-engine
- View open source insights on deps.dev
- Purl
- pkg:npm/%40ckeditor/ckeditor5-engine
npm / ckeditor5
Package
- Name
- ckeditor5
- View open source insights on deps.dev
- Purl
- pkg:npm/ckeditor5
npm / @ckeditor/ckeditor5-engine
Package
- Name
- @ckeditor/ckeditor5-engine
- View open source insights on deps.dev
- Purl
- pkg:npm/%40ckeditor/ckeditor5-engine