Zero Radar
← feed
LowVulnerabilityCVE-2026-116687updated 28 Oct 2026, 15:25 UTC

CKEditor: Cross-site scripting (XSS) in the engine package

Fix availableOfficial, 2 sources
SeverityLowCVSS 3.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesckeditor5 47.7.4, @ckeditor/ckeditor5-engine 47.7.4, ckeditor5 48.5.1, @ckeditor/ckeditor5-engine 48.5.1 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
ckeditor5 · npm>= 29.0.0, < 47.7.447.7.4
@ckeditor/ckeditor5-engine · npm>= 29.0.0, < 47.7.447.7.4
ckeditor5 · npm>= 48.0.0, < 48.5.148.5.1
@ckeditor/ckeditor5-engine · npm>= 48.0.0, < 48.5.148.5.1

Timeline

  1. 27 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 21:05 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 21:06 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 15:25 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116687 · GHSA-v6mg-96c6-gmpq
CVSS
3.1 / 10
Disclosed
27 Oct 2026, 20:17 UTC
On Zero Radar
27 Oct 2026, 21:06 UTC (49 min after disclosure)
Last change
28 Oct 2026, 15:25 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

CKEditor: Cross-site scripting (XSS) in the engine package · Zero Radar