ckeditor @ckeditor/ckeditor5-html-support vulnerabilities

Latest ckeditor @ckeditor/ckeditor5-html-support CVEs

Newest publication first

1. CVE-2026-28343 CKEditor: Cross-site scripting (XSS) in the HTML Support package

   Published 2026-03-05

   Medium·CVSS 6.1 EPSS 0.32%

   CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by insert...

2. CVE-2022-31175 Cross-site scripting caused by the editor instance destroying process in ckeditor5

   Published 2022-08-03

   Medium·CVSS 4.7 EPSS 0.88%

   CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affect...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.