CVE-2026-116687

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions 29.0.0 through 47.7.3 CKEditor 5 versions 48.0.0 through 48.5.0

Description Specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and configured to allow object content. Processing this content allows the execution of attacker-controlled JavaScript within a browser context that is isolated from the origin of the application embedding the editor.

Recommendations Update to version 47.7.4. Update to version 48.5.1. Restrict the General HTML Support configuration to disallow object content as a mitigation measure.