# CVE-2026-116687: CKEditor: Cross-site scripting (XSS) in the engine package

Source: https://junglewise.ai/threats/cve-2026-116687-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116687 · Severity: low · CVSS 3.1 · Published 2026-10-27

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.

Technologies: [ckeditor5 (npm)](https://junglewise.ai/threats/technologies/ckeditor5). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116687 being exploited in the wild.

**How severe is CVE-2026-116687?** Low severity, with a CVSS score of 3.1, published 27 October 2026.

**Which products and versions are affected?** @ckeditor/ckeditor5-engine (npm) >= 29.0.0, < 47.7.4, SEMVER:introduced=29.0.0,fixed=47.7.4; ckeditor5 (npm) >= 29.0.0, < 47.7.4, SEMVER:introduced=29.0.0,fixed=47.7.4.

**Is there a fix for CVE-2026-116687?** Yes. @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later; ckeditor5 (npm): upgrade to 47.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-116687?** Check whether you run @ckeditor/ckeditor5-engine (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later

  ```sh
  npm install @ckeditor/ckeditor5-engine@47.7.4
  ```

- ckeditor5 (npm): upgrade to 47.7.4 or later

  ```sh
  npm install ckeditor5@47.7.4
  ```


## Affected products

- @ckeditor/ckeditor5-engine (npm) >= 29.0.0, < 47.7.4, SEMVER:introduced=29.0.0,fixed=47.7.4
- ckeditor5 (npm) >= 29.0.0, < 47.7.4, SEMVER:introduced=29.0.0,fixed=47.7.4

## Identifiers

- CVE-2026-116687
- GHSA-v6mg-96c6-gmpq

## Related threats

- [CKEditor 5 prototype pollution via es-toolkit in style processing](https://junglewise.ai/threats/cve-2026-116688-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc)
- [CKEditor 5 cross-site scripting in HTML Support](https://junglewise.ai/threats/cve-2026-28343-ckeditor-5-cross-site-scripting-in-html-support)
- [CKEditor 5 clipboard cross-site scripting](https://junglewise.ai/threats/cve-2024-45613-ckeditor-5-clipboard-cross-site-scripting)
- [CKEditor5 cross-site scripting in HTML embed](https://junglewise.ai/threats/cve-2022-48110-ckeditor5-cross-site-scripting-in-html-embed)