CVE-2026-28343

MEDIUM

CKEditor5 29.0.0-47.6.0 - Cross-Site Scripting via General HTML Support Feature

Title source: llm

Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93

X_Refsource_Misc x_refsource_misc

https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0

Release Notes x_refsource_misc

https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0

Scores

CVSS v3 6.4

EPSS 0.0005

EPSS Percentile 15.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (4)

ckeditor/ckeditor5 < 47.6.0

ckeditor/ckeditor5 >= 29.0.0, < 47.6.0

ckeditor/ckeditor5-html-support 29.0.0 - 47.6.0npm

npm/ckeditor5 29.0.0 - 47.6.0npm

Published Mar 05, 2026

Tracked Since Mar 06, 2026