Is CVE-2026-116688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116688 being exploited in the wild.

How severe is CVE-2026-116688?

High severity, with a CVSS score of 8.1, published 27 October 2026.

Which products and versions are affected?

CKSource CKEditor 5 45.0.0 to 47.7.3 and 48.0.0 to 48.5.0; @ckeditor/ckeditor5-engine (npm) >= 45.0.0, = 45.0.0, < 47.7.4, SEMVER:introduced=45.0.0,fixed=47.7.4.

Is there a fix for CVE-2026-116688?

Yes. @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later; ckeditor5 (npm): upgrade to 47.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116688 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116688?

Check whether you run CKSource CKEditor 5, @ckeditor/ckeditor5-engine (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116688: CKEditor 5 prototype pollution via es-toolkit in style processing

Q: Is there a fix for CVE-2026-116688?

Yes. @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later; ckeditor5 (npm): upgrade to 47.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116688 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116688?

Check whether you run CKSource CKEditor 5, @ckeditor/ckeditor5-engine (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116688 · Severity: high · CVSS 8.1 · Published 2026-10-27

CKEditor 5 is a web-based rich-text editor used in content management and form applications. An attacker can craft malicious editor content that exploits a prototype pollution vulnerability in a bundled library (es-toolkit) to execute arbitrary JavaScript code in users' browsers, potentially stealing credentials, session tokens, or sensitive data.

Technologies: ckeditor5 (npm). Vendors: CKSource, npm.

Quick answers

Is CVE-2026-116688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116688 being exploited in the wild.
How severe is CVE-2026-116688?: High severity, with a CVSS score of 8.1, published 27 October 2026.
Which products and versions are affected?: CKSource CKEditor 5 45.0.0 to 47.7.3 and 48.0.0 to 48.5.0; @ckeditor/ckeditor5-engine (npm) >= 45.0.0, < 47.7.4, SEMVER:introduced=45.0.0,fixed=47.7.4; ckeditor5 (npm) >= 45.0.0, < 47.7.4, SEMVER:introduced=45.0.0,fixed=47.7.4.
Is there a fix for CVE-2026-116688?: Yes. @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later; ckeditor5 (npm): upgrade to 47.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116688 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116688?: Check whether you run CKSource CKEditor 5, @ckeditor/ckeditor5-engine (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later
```
npm install @ckeditor/ckeditor5-engine@47.7.4
```
ckeditor5 (npm): upgrade to 47.7.4 or later
```
npm install ckeditor5@47.7.4
```

Technical details

The vulnerability is a prototype pollution flaw in the bundled es-toolkit library (versions before 1.52.0 in CKEditor 5). The attack occurs when CKEditor processes incoming HTML style attributes; crafted attribute values can trigger the vulnerable code path and pollute the JavaScript object prototype, leading to arbitrary code execution in the user's browser context. No user interaction beyond opening a document with malicious content is required.

Affected products

CKSource CKEditor 5 45.0.0 to 47.7.3 and 48.0.0 to 48.5.0

Identifiers

CVE-2026-116688
GHSA-rh54-vffm-5fvp

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.