{"affected":[{"product":"ckeditor5","source":"CNA: GitHub_M","vendor":"ckeditor","versions":[{"status":"affected","version":">= 29.0.0, < 47.7.4"},{"status":"affected","version":">= 48.0.0, < 48.5.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"ckeditor5","product":"ckeditor5","source":"OSV GHSA-v6mg-96c6-gmpq","vendor":"","versions":[{"events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}],"lessThan":"47.7.4","status":"affected","version":"29.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@ckeditor/ckeditor5-engine","product":"@ckeditor/ckeditor5-engine","source":"OSV GHSA-v6mg-96c6-gmpq","vendor":"","versions":[{"events":[{"introduced":"29.0.0"},{"fixed":"47.7.4"}],"lessThan":"47.7.4","status":"affected","version":"29.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"ckeditor5","product":"ckeditor5","source":"OSV GHSA-v6mg-96c6-gmpq","vendor":"","versions":[{"events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}],"lessThan":"48.5.1","status":"affected","version":"48.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@ckeditor/ckeditor5-engine","product":"@ckeditor/ckeditor5-engine","source":"OSV GHSA-v6mg-96c6-gmpq","vendor":"","versions":[{"events":[{"introduced":"48.0.0"},{"fixed":"48.5.1"}],"lessThan":"48.5.1","status":"affected","version":"48.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-116687","cwes":["CWE-79"],"description":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.","epss":{"date":"2026-11-02","percentile":0.16765,"score":0.00252},"exploits":[],"kev":null,"metrics":[{"score":3.1,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793707647484,"publishedAt":1793129591074,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-v6mg-96c6-gmpq"}],"remediation":[{"kind":"fix","source":"OSV GHSA-v6mg-96c6-gmpq","text":"ckeditor5 (npm): OSV reports a fixed version 47.7.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"},{"kind":"fix","source":"OSV GHSA-v6mg-96c6-gmpq","text":"@ckeditor/ckeditor5-engine (npm): OSV reports a fixed version 47.7.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"},{"kind":"fix","source":"OSV GHSA-v6mg-96c6-gmpq","text":"ckeditor5 (npm): OSV reports a fixed version 48.5.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"},{"kind":"fix","source":"OSV GHSA-v6mg-96c6-gmpq","text":"@ckeditor/ckeditor5-engine (npm): OSV reports a fixed version 48.5.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq"}],"revision":"63658b7bab38e769e5fb8ed2d2280ae99b2f66790326d8719d1c2e9ab92b02cc","sources":[{"modifiedAt":1793707647484,"name":"CNA: GitHub_M","retrievedAt":1793711368651,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116687"},{"modifiedAt":1793135703823,"name":"OSV / GitHub Security Advisories","retrievedAt":1793711370540,"url":"https://osv.dev/vulnerability/GHSA-v6mg-96c6-gmpq"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793711405556,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116687"}],"ssvc":{"assessedAt":1793707626113,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CKEditor: Cross-site scripting (XSS) in the engine package","updatedAt":1793711405556}