CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package

What is CVE-2026-28343?

CVE-2026-28343 is a medium-severity cross-site scripting vulnerability in ckeditor5, published on 5 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Weakness: CWE-79

Which versions are affected by CVE-2026-28343?

4 open source packages ship an affected version, including @ckeditor/ckeditor5-html-support and ckeditor5. It affects 1 product.

Products include Ckeditor Ckeditor5.

How do I fix CVE-2026-28343?

Upgrade @ckeditor/ckeditor5-html-support to 47.6.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-28343 being exploited?

There is no known exploitation of CVE-2026-28343 in the wild and no public exploit code.

Other vulnerabilities in ckeditor5

• CVE-2021-21254 Regular expression Denial of Service in Markdown plugin Medium 6.5
• CVE-2024-45613 CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jrqm-vmqc-gm93, UBUNTU-CVE-2026-28343.