{"id":"ghsa-ghsa-v6mg-96c6-gmpq","seq":1711761,"kind":"advisory","title":"CKEditor: Cross-site scripting (XSS) in the engine package","url":"https://github.com/advisories/GHSA-v6mg-96c6-gmpq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-v6mg-96c6-gmpq","summary":"影響: npm:ckeditor5 >= 29.0.0, < 47.7.4 → 47.7.4, npm:@ckeditor/ckeditor5-engine >= 29.0.0, < 47.7.4 → 47.7.4, npm:ckeditor5 >= 48.0.0, < 48.5.1 → 48.5.1, npm:@ckeditor/ckeditor5-engine >= 48.0.0, < 48.5.1 → 48.5.1\nA Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor. This vulnerability affects only installations where General HTML Support is enabled and configured to allow the af…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-116687"],"tags":["GHSA-v6mg-96c6-gmpq","ckeditor5","@ckeditor/ckeditor5-engine","ckeditor5","@ckeditor/ckeditor5-engine"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:05:13.000Z","fetched_at":"2026-10-27T21:17:52.472Z"}