CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116688?
CVE-2026-116688 is a high-severity vulnerability in ckeditor5, published on 27 Oct 2026.
Official description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-116688?
8 open source packages ship an affected version, including @ckeditor/ckeditor5-engine and ckeditor5.
| Package | Affected | Fixed in |
|---|---|---|
@ckeditor/ckeditor5-engine npm | From 45.0.0 | 47.7.4 |
@ckeditor/ckeditor5-engine npm | From 45.0.0 | 47.7.4 |
@ckeditor/ckeditor5-engine npm | From 48.0.0 | 48.5.1 |
@ckeditor/ckeditor5-engine npm | From 48.0.0 | 48.5.1 |
ckeditor5 npm | From 45.0.0 | 47.7.4 |
ckeditor5 npm | From 45.0.0 | 47.7.4 |
2 more packages
ckeditor5 npm | From 48.0.0 | 48.5.1 |
ckeditor5 npm | From 48.0.0 | 48.5.1 |
How do I fix CVE-2026-116688?
Upgrade @ckeditor/ckeditor5-engine to a fixed version for your release line: 47.7.4 or 48.5.1.
Is CVE-2026-116688 being exploited?
There is no known exploitation of CVE-2026-116688 in the wild and no public exploit code.
Sources
Also known as GHSA-rh54-vffm-5fvp, UBUNTU-CVE-2026-116688.