Every CVE Search/ Get API key

CVE-2026-28343

CKEditor: Cross-site scripting (XSS) in the HTML Support package

6.4 MediumFix available

CVE-2026-28343 is a medium vulnerability (CVSS 6.4) in Ckeditor Ckeditor5, published March 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in @ckeditor/ckeditor5-html-support 47.6.0.

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Mar 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

CKEditor: Cross-site scripting (XSS) in the HTML Support package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Record
CVE-2026-28343
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-9867 6.4

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Record
EUVD-2026-9867
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jrqm-vmqc-gm93 6.4

CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.

This vulnerability affects only installations where the editor configuration meets the following criteria:

Patches

The problem has been recognized and patched. The fix will be available in version 47.6.0 (and above).

Workarounds

CKEditor 5 recommends configuring General HTML Support securely to ensure that unsafe content is not accepted. Please refer to the Security section for detailed guidance.

Credits

CKEditor 5 would like to thank:

  • Emilio Kevin
  • Jeongwoo Lee, Younsoung Kim, Minseok Kim and Jinyeong Kim from ENKI Whitehat

for responsibly reporting this vulnerability.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Record
GHSA-jrqm-vmqc-gm93
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.4

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Record
CVE-2026-28343
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.4

CKEditor: Cross-site scripting (XSS) in the HTML Support package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Record
CVE-2026-28343
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-jrqm-vmqc-gm93 6.4

CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package

Impact

A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.

This vulnerability affects only installations where the editor configuration meets the following criteria:

Patches

The problem has been recognized and patched. The fix will be available in version 47.6.0 (and above).

Workarounds

CKEditor 5 recommends configuring General HTML Support securely to ensure that unsafe content is not accepted. Please refer to the Security section for detailed guidance.

Credits

CKEditor 5 would like to thank:

  • Emilio Kevin
  • Jeongwoo Lee, Younsoung Kim, Minseok Kim and Jinyeong Kim from ENKI Whitehat

for responsibly reporting this vulnerability.

For more information

Email us at [email protected] if you have any questions or comments about this advisory.

Record
GHSA-jrqm-vmqc-gm93
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2026-28343 6.4

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Record
UBUNTU-CVE-2026-28343
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@ckeditor/ckeditor5-html-support
npm
 29.0.0 up to 47.6.0
47.6.0
ckeditor5
npm
 29.0.0 up to 47.6.0
47.6.0
ckeditor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-24.5.7+dfsg-2ubuntu0.16.04.1~esm14.5.7+dfsg-2ubuntu0.16.04.1~esm24.5.7+dfsg-2ubuntu0.16.04.1~esm3
 None known
ldap-account-manager
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.9-15.1-15.2-15.2-1ubuntu1
 None known
request-tracker4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.2.11-24.2.12-34.2.12-44.2.12-5
 None known
ckeditor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5.7+dfsg-24.5.7+dfsg-2ubuntu0.18.04.14.5.7+dfsg-2ubuntu0.18.04.1+esm14.5.7+dfsg-2ubuntu0.18.04.1+esm2
 None known
ckeditor3
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-1
 None known
ldap-account-manager
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.7-16.1-16.2-1
 None known
request-tracker4
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.4.1-54.4.2-14.4.2-24.4.2-2ubuntu0.1~esm1
 None known
ckeditor
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.11.1+dfsg-14.12.1+dfsg-14.12.1+dfsg-1ubuntu0.14.12.1+dfsg-1ubuntu0.1+esm14.12.1+dfsg-1ubuntu0.1+esm2
 None known
Show 16 moreShow less
Affected packages
PackageAffectedFixed
ckeditor3
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-33.6.6.1+dfsg-4
 None known
ldap-account-manager
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.7-1
 None known
request-tracker4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.4.3-24.4.3-2+deb10u3build0.20.04.1
 None known
ckeditor3
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-7
 None known
ldap-account-manager
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.5-17.7-1
 None known
request-tracker4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu1.22.04.1
 None known
ckeditor
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.16.0+dfsg-24.16.2+dfsg-14.16.2+dfsg-1ubuntu0.1~esm14.16.2+dfsg-1ubuntu0.1~esm2
 None known
ckeditor3
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.6.6.1+dfsg-7
 None known
ldap-account-manager
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.3-18.5-1
 None known
request-tracker4
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.4+dfsg-2ubuntu14.4.4+dfsg-2ubuntu24.4.7+dfsg-1
 None known
ckeditor
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
4.22.1+dfsg1-24.22.1+dfsg1-2ubuntu0.24.04.1~esm14.22.1+dfsg1-2ubuntu0.24.04.1~esm2
 None known
ckeditor
Ubuntu:25.10
 All versions, plus listed versions
4.22.1+dfsg1-2ubuntu14.22.1+dfsg1-2ubuntu1.1
 None known
ldap-account-manager
Ubuntu:25.10
 All versions, plus listed versions
9.0-1
 None known
request-tracker4
Ubuntu:25.10
 All versions, plus listed versions
4.4.7+dfsg-4syncable1
 None known
ldap-account-manager
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0-19.0-1build1
 None known
request-tracker4
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.7+dfsg-4syncable1
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open