CKEditor: Cross-site scripting (XSS) in the engine package

影響: npm:ckeditor5 >= 29.0.0, < 47.7.4 → 47.7.4, npm:@ckeditor/ckeditor5-engine >= 29.0.0, < 47.7.4 → 47.7.4, npm:ckeditor5 >= 48.0.0, < 48.5.1 → 48.5.1, npm:@ckeditor/ckeditor5-engine >= 48.0.0, < 48.5.1 → 48.5.1

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor. This vulnerability affects only installations where General HTML Support is enabled and configured to allow the af…

在 GitHub Advisory Database 阅读

2026/10/28 06:05，GitHub Advisory Database 发布了“CKEditor: Cross-site scripting (XSS) in the engine package”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js。CVE：CVE-2026-116687。