## CKEditor: Cross-site scripting (XSS) in the engine package

- 種別: advisory
- 重大度: low
- 関連技術: nodejs
- CVE: CVE-2026-116687
- 公開日時: 2026-10-27T21:05:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-v6mg-96c6-gmpq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-v6mg-96c6-gmpq

影響: npm:ckeditor5 >= 29.0.0, < 47.7.4 → 47.7.4, npm:@ckeditor/ckeditor5-engine >= 29.0.0, < 47.7.4 → 47.7.4, npm:ckeditor5 >= 48.0.0, < 48.5.1 → 48.5.1, npm:@ckeditor/ckeditor5-engine >= 48.0.0, < 48.5.1 → 48.5.1
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor. This vulnerability affects only installations where General HTML Support is enabled and configured to allow the af…