Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116688 · GHSA-rh54-vffm-5fvp

CKEditor: Cross-site scripting (XSS) in the engine package

Risk score
54/100
CVSS
8.1 v3.1
Published
27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthor…
Affected
ckeditor5 (npm) >= 45.0.0, < 47.7.4; @ckeditor/ckeditor5-engine (npm) >= 45.0.0, < 47.7.4; ckeditor5 (npm) >= 48.0.0, < 48.5.1; @ckeditor/ckeditor5-engine (npm) >= 48.0.0, < 48.5.1
Fix
Upgrade ckeditor5 to 47.7.4 or 48.5.1; @ckeditor/ckeditor5-engine to 47.7.4 or 48.5.1 (whichever matches your release line) or later.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 8.1 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ckeditor5npm>= 45.0.0, < 47.7.447.7.4
@ckeditor/ckeditor5-enginenpm>= 45.0.0, < 47.7.447.7.4
ckeditor5npm>= 48.0.0, < 48.5.148.5.1
@ckeditor/ckeditor5-enginenpm>= 48.0.0, < 48.5.148.5.1

References

Original description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

Last activity 27 Oct 2026. Patch Forecast updates every hour.