CVE-2026-116687: CKEditor: Cross-site scripting (XSS) in the engine package
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.
References
- github.com/advisories/GHSA-v6mg-96c6-gmpq
- github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
- github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
- github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
- github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
- github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
- nvd.nist.gov/vuln/detail/CVE-2026-116687
Code Behaviors & Features
Detect and mitigate CVE-2026-116687 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →