CVE-2026-116688

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions 45.0.0 through 47.7.3 CKEditor 5 versions 48.0.0 through 48.5.0

Description A prototype pollution issue exists in the es-toolkit library used by the engine. This occurs when the editor processes incoming style attribute values, which can lead to unauthorized JavaScript execution in the browser, known as Cross-Site Scripting (XSS). Prototype pollution is a technique where an attacker manipulates the prototype of a JavaScript object to inject properties that can alter the behavior of the application.

Recommendations Update to version 47.7.4 (LTS). Update to version 48.5.1.