# CVE-2022-48110: CKEditor5 cross-site scripting in HTML embed

Source: https://junglewise.ai/threats/cve-2022-48110-ckeditor5-cross-site-scripting-in-html-embed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-48110 · Severity: low · CVSS 3.1 · Published 2023-02-13

CKEditor5 is a rich text editor used to build content editing capabilities into websites and applications. A cross-site scripting (XSS) vulnerability in the HTML embed feature allows attackers to inject malicious scripts that execute in users' browsers when they view or interact with edited content. This could lead to account compromise, credential theft, or malware distribution to website visitors.

Technologies: [ckeditor5 (npm)](https://junglewise.ai/threats/technologies/ckeditor5). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-48110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-48110 being exploited in the wild.

**How severe is CVE-2022-48110?** Low severity, with a CVSS score of 3.1, published 13 February 2023.

**Which products and versions are affected?** ckeditor5 (npm) SEMVER:introduced=0,fixed=36.0.0.

**Is there a fix for CVE-2022-48110?** Yes. ckeditor5 (npm): upgrade to 36.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-48110 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-48110?** Check whether you run ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckeditor5 (npm): upgrade to 36.0.0 or later

  ```sh
  npm install ckeditor5@36.0.0
  ```


## Technical details

CKEditor5 versions up to 35.4.0 contain a stored XSS vulnerability in the HTML embed feature (htmlEmbed plugin). The vulnerability arises from insufficient input sanitization when processing embedded HTML content, allowing an attacker to inject arbitrary scripts. The attack requires user interaction (opening a document with malicious embedded HTML) but does not require authentication. While the vendor notes that integrators can configure security settings and safe defaults exist (e.g., config.htmlEmbed.showPreviews defaults to false), deployments with permissive settings remain vulnerable. The issue is fixed in version 36.0.0 and later.

## Affected products

- CKSource CKEditor5 before 36.0.0

## Identifiers

- CVE-2022-48110
- GHSA-6p89-3p7c-qrhv

## Timeline

- 2023-02-13: disclosed: Published in OSV as GHSA-6p89-3p7c-qrhv
- 2023-02-15: patched: Note withdrawn 2023-02-15 per vendor statement; fix available in 36.0.0
- 2022: other: CVE-2022-48110 assigned

## References

- [https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html](https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html)

## Related threats

- [CKEditor 5 prototype pollution via es-toolkit in style processing](https://junglewise.ai/threats/cve-2026-116688-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc)
- [CKEditor: Cross-site scripting (XSS) in the engine package](https://junglewise.ai/threats/cve-2026-116687-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc)
- [CKEditor 5 cross-site scripting in HTML Support](https://junglewise.ai/threats/cve-2026-28343-ckeditor-5-cross-site-scripting-in-html-support)
- [CKEditor 5 clipboard cross-site scripting](https://junglewise.ai/threats/cve-2024-45613-ckeditor-5-clipboard-cross-site-scripting)