Go to packages list

ckeditor5

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 1HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 3 versions
  • 2LowAffects 4 versions
Severity distribution (all time)
6vulnerabilities
  • Critical0 (0.0%)
  • High1 (16.7%)
  • Medium0 (0.0%)
  • Moderate3 (50.0%)
  • Low2 (33.3%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (6)

Known vulnerabilities affecting ckeditor5, based on data from OSV.

Vulnerabilities affecting ckeditor5
IDSeveritySummaryAffected versionsPublishedSource
GHSA-rh54-vffm-5fvpHighCKEditor: Cross-site scripting (XSS) in the engine package### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the `es-toolkit` library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming `style` attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5. ### Patches The problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4`
  • >= 45.0.0, < 47.7.4
  • >= 48.0.0, < 48.5.1
GitHub (opens in a new tab)
GHSA-v6mg-96c6-gmpqLowCKEditor: Cross-site scripting (XSS) in the engine package### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor. This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content. ### Patches The problem has been recognized and patched. The fix wi
  • >= 29.0.0, < 47.7.4
  • >= 48.0.0, < 48.5.1
GitHub (opens in a new tab)
GHSA-jrqm-vmqc-gm93ModerateCKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This vulnerability affects only installations where the editor configuration meets the following criteria: * [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html) is enabled, * General HTML Support configuration allows inserting uns
  • >= 29.0.0, < 47.6.0
GitHub (opens in a new tab)
GHSA-x9gp-vjh6-3wv6LowCKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects **only** installations where the editor configuration meets one of the following criteria: - [HTML embed plugin](https://ckeditor.com/docs/ckeditor5/latest/features/html/html-embed.html) is enabled - Custom plugi
  • >= 46.0.0, < 46.0.3
  • >= 44.2.0, < 45.2.2
GitHub (opens in a new tab)
GHSA-rgg8-g5x8-wr9vModerateCross-site scripting (XSS) in the clipboard package### Impact During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects **only** installations where the editor configuration meets the following criteria: 1. The [**Block Toolbar**](https://ckeditor.com/docs/ckeditor5/latest/getting-started/setup/toolbar.h
  • >= 40.0.0, < 43.1.1
GitHub (opens in a new tab)
GHSA-6p89-3p7c-qrhvModerateCross-site scripting in CKEditor5CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
  • < 36.0.0
GitHub (opens in a new tab)
  • GHSA-rh54-vffm-5fvpHigh
    CKEditor: Cross-site scripting (XSS) in the engine package
    • >= 45.0.0, < 47.7.4
    • >= 48.0.0, < 48.5.1
    GitHub (opens in a new tab)

    ### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the `es-toolkit` library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming `style` attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5. ### Patches The problem has been recognized and patched. The fix will be available in version `48.5.1` (and above) and `47.7.4`

    CVE: CVE-2026-116688

  • GHSA-v6mg-96c6-gmpqLow
    CKEditor: Cross-site scripting (XSS) in the engine package
    • >= 29.0.0, < 47.7.4
    • >= 48.0.0, < 48.5.1
    GitHub (opens in a new tab)

    ### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor. This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content. ### Patches The problem has been recognized and patched. The fix wi

    CVE: CVE-2026-116687

  • GHSA-jrqm-vmqc-gm93Moderate
    CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
    • >= 29.0.0, < 47.6.0
    GitHub (opens in a new tab)

    ### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This vulnerability affects only installations where the editor configuration meets the following criteria: * [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html) is enabled, * General HTML Support configuration allows inserting uns

    CVE: CVE-2026-28343

  • GHSA-x9gp-vjh6-3wv6Low
    CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package
    • >= 46.0.0, < 46.0.3
    • >= 44.2.0, < 45.2.2
    GitHub (opens in a new tab)

    ### Impact A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects **only** installations where the editor configuration meets one of the following criteria: - [HTML embed plugin](https://ckeditor.com/docs/ckeditor5/latest/features/html/html-embed.html) is enabled - Custom plugi

    CVE: CVE-2025-58064

  • GHSA-rgg8-g5x8-wr9vModerate
    Cross-site scripting (XSS) in the clipboard package
    • >= 40.0.0, < 43.1.1
    GitHub (opens in a new tab)

    ### Impact During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability affects **only** installations where the editor configuration meets the following criteria: 1. The [**Block Toolbar**](https://ckeditor.com/docs/ckeditor5/latest/getting-started/setup/toolbar.h

    CVE: CVE-2024-45613

  • GHSA-6p89-3p7c-qrhvModerate
    Cross-site scripting in CKEditor5
    • < 36.0.0
    GitHub (opens in a new tab)

    CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).

    CVE: CVE-2022-48110

Showing 1-6 of 6 vulnerabilities