{"id":"CVE-2026-116687","aliases":["EUVD-2026-111365","GHSA-v6mg-96c6-gmpq","UBUNTU-CVE-2026-116687"],"status":"published","title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00252,"percentile":0.16884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-27T19:33:11Z","modified":"2026-11-03T13:17:19Z","fixes":[{"ecosystem":"npm","package":"ckeditor5","fixed_in":["47.7.4","48.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@ckeditor/ckeditor5-engine","fixed_in":["47.7.4","48.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ckeditor5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@ckeditor/ckeditor5-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"ckeditor5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@ckeditor/ckeditor5-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"ckeditor5","ranges":[{"type":"SEMVER","events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@ckeditor/ckeditor5-engine","ranges":[{"type":"SEMVER","events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}]}]},{"source":"osv","ecosystem":"npm","package":"ckeditor5","ranges":[{"type":"SEMVER","events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@ckeditor/ckeditor5-engine","ranges":[{"type":"SEMVER","events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg1-3","4.5.6+dfsg-1","4.5.7+dfsg-1","4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.16.04.1~esm1","4.5.7+dfsg-2ubuntu0.16.04.1~esm2","4.5.7+dfsg-2ubuntu0.16.04.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9-1","5.1-1","5.2-1","5.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.11-2","4.2.12-3","4.2.12-4","4.2.12-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.7+dfsg-2","4.5.7+dfsg-2ubuntu0.18.04.1","4.5.7+dfsg-2ubuntu0.18.04.1+esm1","4.5.7+dfsg-2ubuntu0.18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-5","4.4.2-1","4.4.2-2","4.4.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1+dfsg-1","4.12.1+dfsg-1","4.12.1+dfsg-1ubuntu0.1","4.12.1+dfsg-1ubuntu0.1+esm1","4.12.1+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-3","3.6.6.1+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-2","4.4.3-2+deb10u3build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5-1","7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.0+dfsg-2","4.16.2+dfsg-1","4.16.2+dfsg-1ubuntu0.1~esm1","4.16.2+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ckeditor3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.6.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.3-1","8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu2","4.4.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ckeditor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.22.1+dfsg1-2","4.22.1+dfsg1-2ubuntu0.24.04.1~esm1","4.22.1+dfsg1-2ubuntu0.24.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ldap-account-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0-1","9.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]}],"products":[{"vendor":"ckeditor","product":"ckeditor5"}],"references":[{"url":"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116687.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116687","tags":["advisory"]},{"url":"https://github.com/ckeditor/ckeditor5","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-116687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116687","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116687","title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","status":"published","published":"2026-10-27T19:33:11.074Z","modified":"2026-11-03T12:07:27.484Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T13:57:27.751141Z"}],"euvd":[{"id":"EUVD-2026-111365","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","status":"published","published":"2026-10-27T19:33:11Z","modified":"2026-11-03T12:07:27Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T13:54:42.043274Z"}],"ghsa":[{"id":"GHSA-v6mg-96c6-gmpq","title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.\n\nThis vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.","status":"published","published":"2026-10-27T21:05:13Z","modified":"2026-10-27T21:05:13Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:38.969831Z"}],"nvd":[{"id":"CVE-2026-116687","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","status":"published","published":"2026-10-27T20:17:13.89Z","modified":"2026-11-03T13:17:19.897Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T18:16:46.478505Z"}],"osv":[{"id":"CVE-2026-116687","title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","status":"published","published":"2026-10-27T19:33:11.074Z","modified":"2026-11-05T02:30:27.189824812Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:08:01.156605Z"},{"id":"GHSA-v6mg-96c6-gmpq","title":"CKEditor: Cross-site scripting (XSS) in the engine package","description":"### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.\n\nThis vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.","status":"published","published":"2026-10-27T21:05:13Z","modified":"2026-10-27T21:15:03.823149549Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"UBUNTU-CVE-2026-116687","description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","status":"published","published":"2026-10-27T20:17:00Z","modified":"2026-10-28T20:17:45.945931975Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:00.081948Z"}]}}