CVE-2026-116688
### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the `es-toolkit` library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming `style` attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5. ### Patches The problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4` (LTS). ### For more information Email us at [[email protected]](mailto:[email protected]) if you have any questions or comments about this advisory.
Properties
- Severity
- high
- Summary
- CKEditor: Cross-site scripting (XSS) in the engine package
- Nvd fetched at
- 2026-10-27T23:33:07.137019+00:00
- Cvss severity
- HIGH
- Cvss score
- 8.1
- Retrieved at
- 2026-10-27T23:34:59+00:00
- Ghsa published
- 2026-10-27T21:05:06Z
- Source url
- https://github.com/advisories/GHSA-rh54-vffm-5fvp
- Ghsa updated
- 2026-10-27T21:05:07Z
- Ghsa id
- GHSA-rh54-vffm-5fvp
- Last source
- GitHub Advisory Database
- Score
- 8.1
- Cvss version
- 3.1
- Cve id
- CVE-2026-116688
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-10-27T23:33:57+00:00
- Is ghsa only
- false
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Published at
- 2026-10-27T20:17:14.037
- Last modified
- 2026-10-27T20:17:14.037
Related Entities (5)
AFFECTS (2)
VULNERABLE_TO (2)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph