CVE-2026-116687 CKEditor: Cross-site scripting (XSS) in the engine package
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116687?
CVE-2026-116687 is a low-severity vulnerability in ckeditor5, published on 27 Oct 2026.
Official description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-116687?
8 open source packages ship an affected version, including @ckeditor/ckeditor5-engine and ckeditor5.
| Package | Affected | Fixed in |
|---|---|---|
@ckeditor/ckeditor5-engine npm | From 29.0.0 | 47.7.4 |
@ckeditor/ckeditor5-engine npm | From 29.0.0 | 47.7.4 |
@ckeditor/ckeditor5-engine npm | From 48.0.0 | 48.5.1 |
@ckeditor/ckeditor5-engine npm | From 48.0.0 | 48.5.1 |
ckeditor5 npm | From 29.0.0 | 47.7.4 |
ckeditor5 npm | From 29.0.0 | 47.7.4 |
2 more packages
ckeditor5 npm | From 48.0.0 | 48.5.1 |
ckeditor5 npm | From 48.0.0 | 48.5.1 |
How do I fix CVE-2026-116687?
Upgrade @ckeditor/ckeditor5-engine to a fixed version for your release line: 47.7.4 or 48.5.1.
Is CVE-2026-116687 being exploited?
There is no known exploitation of CVE-2026-116687 in the wild and no public exploit code.
Sources
Also known as GHSA-v6mg-96c6-gmpq, UBUNTU-CVE-2026-116687.