Skip to content

Product

ckeditor @ckeditor/ckeditor5-engine vulnerabilities

3 published CVES affecting ckeditor @ckeditor/ckeditor5-engine, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
1
Unscored
0
CISA KEV
0

Latest ckeditor @ckeditor/ckeditor5-engine CVEs

Newest publication first

  1. CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

    Published
    HighCVSS 8.1 EPSS 0.50%

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted ed...

  2. CVE-2026-116687 CKEditor: Cross-site scripting (XSS) in the engine package

    Published
    LowCVSS 3.1 EPSS 0.25%

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that co...

  3. CVE-2021-21391 Regular expression Denial of Service in multiple packages

    Published
    MediumCVSS 6.5 EPSS 1.7%

    CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.