CVE-2026-116687— CKEditor: Cross-site scripting (XSS) in the engine package

Quick assessment

Affected

ckeditor ckeditor5

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CKEditor 5 是一款采用 MVC 架构的现代 JavaScript 富文本编辑器。在版本 29.0.0 至 47.7.4 以及 48.5.1 中，若启用了“通用 HTML 支持”（General HTML Support）并特别配置为允许对象（object）内容，则精心构造的标记可能触发跨站脚本（XSS）攻击。处理此类内容时，攻击者可控制的 JavaScript 将在与嵌入该编辑器的应用源隔离的浏览器上下文中执行。该问题已在版本 47.7.4 和 48.5.1 中修复。

CVSS 3.1 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ckeditor	ckeditor5	`>= 29.0.0, < 47.7.4`	affected
		`>= 48.0.0, < 48.5.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CKEditor: Cross-site scripting (XSS) in the engine package

Source: CVE Program / CVE List V5

Vulnerability Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ckeditor	ckeditor5	>= 29.0.0, < 47.7.4	-

II. Public POCs for CVE-2026-116687

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116687

请登录查看更多情报信息。

Other References for CVE-2026-116687 (5)

https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq x_refsource_CONFIRM
https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116687

IV. Related Vulnerabilities

Same product: ckeditor5

Same vendor: ckeditor

Same weakness: CWE-79