CVE-2026-116687 — Vulnerability intelligence
—
Published:
- CVSS
- 3.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.