CVE-2026-116687 in CKEditor
Summary
by MITRE • 10/27/2026
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
CKEditor 5 represents a modern, modular rich-text editing solution built upon an MVC architecture, widely deployed across web applications to facilitate user-generated content creation. The vulnerability identified affects specific version ranges of this library, specifically versions from 29.0.0 up through 47.7.4 and the legacy branch leading up to 48.5.1. This security flaw is not inherent to the core editor functionality but emerges when the General HTML Support feature is explicitly enabled and configured with permissive rules that allow object content types. Under these specific configuration conditions, an attacker can craft malicious markup payloads designed to exploit the parsing logic within the editor's sanitization layer.
The technical root cause of this vulnerability lies in the insufficient validation or escaping mechanisms applied when processing embedded object elements. When General HTML Support is active and permits object tags, the parser fails to adequately neutralize script execution vectors contained within these objects. Consequently, an attacker can inject specially crafted markup that includes executable JavaScript code encapsulated within an object element. Upon rendering this content in a browser environment where CKEditor 5 is embedded, the browser interprets and executes the malicious scripts as if they originated from the trusted application domain. This constitutes a classic Cross-Site Scripting (XSS) flaw, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.
The operational impact of this vulnerability is significant due to its potential for remote code execution within the context of the victim's browser session. Since the executed JavaScript runs in an origin-isolated environment relative to the embedding application, it can still access cookies, local storage, and other sensitive data associated with that domain if same-site policies are not strictly enforced or bypassed via specific attack vectors such as clickjacking or social engineering. Attackers leveraging this flaw could perform actions on behalf of authenticated users, steal session tokens, deface web pages, or redirect victims to malicious sites. The severity is further compounded by the fact that it requires a configuration choice rather than being an out-of-the-box default behavior in all setups, though many enterprise deployments may enable HTML support for flexibility, inadvertently exposing themselves if they do not restrict object content types.
Mitigation strategies primarily involve upgrading to patched versions of CKEditor 5, specifically version 47.7.4 or later for the main branch and version 48.5.1 or later for the legacy branch, where the parsing logic has been hardened against such injection attempts. For organizations unable to immediately upgrade, a critical defensive measure is to disable General HTML Support entirely if rich text formatting with arbitrary HTML is not required. If HTML support must remain enabled, administrators should configure the allowed content rules to explicitly prohibit object tags and other potentially dangerous embedded media types that can carry script payloads. Additionally, implementing strict Content Security Policy (CSP) headers can help mitigate the impact of any successful XSS attempts by restricting the sources from which scripts are permitted to load or execute, thereby adding a layer of defense-in-depth against this type of client-side attack as described in MITRE ATT&CK technique T1059.