CKEditor: Cross-site scripting (XSS) in the engine package

published 2026-10-27 12 d ago modified 2026-11-02 6 d ago also GHSA-rh54-vffm-5fvp , EUVD-2026-111364

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.

Patch / fix

fixed in 2 links 4

npm ckeditor5 47.7.4, 48.5.1
npm @ckeditor/ckeditor5-engine 47.7.4, 48.5.1

github.com/ckeditor/ckeditor5@4d9c5bb commit
github.com/ckeditor/ckeditor5@a750e38 commit
github.com/ckeditor/ckeditor5/releases/tag/v47.7.4 release
github.com/ckeditor/ckeditor5/releases/tag/v48.5.1 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 d ago (2026-11-02)

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	ckeditor5	>=45.0.0, <47.7.4 >=48.0.0, <48.5.1	47.7.4 48.5.1
npm	@ckeditor/ckeditor5-engine	>=45.0.0, <47.7.4 >=48.0.0, <48.5.1	47.7.4 48.5.1

Affected products

ckeditor ckeditor5

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary