CVE-2026-116688— CKEditor: Cross-site scripting (XSS) in the engine package

Quick assessment

Affected

ckeditor ckeditor5

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CKEditor 5 是一款采用 MVC 架构的现代 JavaScript 富文本编辑器。在版本 45.0.0 至 47.7.4，以及 48.5.1 之前的版本中，其引擎使用了存在漏洞的 es-toolkit 库。当 CKEditor 处理传入的样式属性值时，可能触发该库的原型污染行为。攻击者可通过构造特定的编辑器内容，在浏览器中引发未经授权的 JavaScript 代码执行。该问题已在版本 47.7.4 和 48.5.1 中修复。

CVSS 8.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ckeditor	ckeditor5	`>= 45.0.0, < 47.7.4`	affected
		`>= 48.0.0, < 48.5.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CKEditor: Cross-site scripting (XSS) in the engine package

Source: CVE Program / CVE List V5

Vulnerability Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ckeditor	ckeditor5	>= 45.0.0, < 47.7.4	-

II. Public POCs for CVE-2026-116688

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116688

请登录查看更多情报信息。

Other References for CVE-2026-116688 (5)

https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp x_refsource_CONFIRM
https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423 x_refsource_MISC
https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116688

IV. Related Vulnerabilities

Same product: ckeditor5

Same vendor: ckeditor

Same weakness: CWE-79