# CVE-2026-116688: CKEditor 5 prototype pollution via es-toolkit in style processing

Source: https://junglewise.ai/threats/cve-2026-116688-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116688 · Severity: high · CVSS 8.1 · Published 2026-10-27

CKEditor 5 is a web-based rich-text editor used in content management and form applications. An attacker can craft malicious editor content that exploits a prototype pollution vulnerability in a bundled library (es-toolkit) to execute arbitrary JavaScript code in users' browsers, potentially stealing credentials, session tokens, or sensitive data.

Technologies: [ckeditor5 (npm)](https://junglewise.ai/threats/technologies/ckeditor5). Vendors: [CKSource](https://junglewise.ai/threats/vendors/cksource), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116688 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116688 being exploited in the wild.

**How severe is CVE-2026-116688?** High severity, with a CVSS score of 8.1, published 27 October 2026.

**Which products and versions are affected?** CKSource CKEditor 5 45.0.0 to 47.7.3 and 48.0.0 to 48.5.0; @ckeditor/ckeditor5-engine (npm) >= 45.0.0, < 47.7.4, SEMVER:introduced=45.0.0,fixed=47.7.4; ckeditor5 (npm) >= 45.0.0, < 47.7.4, SEMVER:introduced=45.0.0,fixed=47.7.4.

**Is there a fix for CVE-2026-116688?** Yes. @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later; ckeditor5 (npm): upgrade to 47.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116688 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116688?** Check whether you run CKSource CKEditor 5, @ckeditor/ckeditor5-engine (npm) or ckeditor5 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @ckeditor/ckeditor5-engine (npm): upgrade to 47.7.4 or later

  ```sh
  npm install @ckeditor/ckeditor5-engine@47.7.4
  ```

- ckeditor5 (npm): upgrade to 47.7.4 or later

  ```sh
  npm install ckeditor5@47.7.4
  ```


## Technical details

The vulnerability is a prototype pollution flaw in the bundled es-toolkit library (versions before 1.52.0 in CKEditor 5). The attack occurs when CKEditor processes incoming HTML style attributes; crafted attribute values can trigger the vulnerable code path and pollute the JavaScript object prototype, leading to arbitrary code execution in the user's browser context. No user interaction beyond opening a document with malicious content is required.

## Affected products

- CKSource CKEditor 5 45.0.0 to 47.7.3 and 48.0.0 to 48.5.0

## Identifiers

- CVE-2026-116688
- GHSA-rh54-vffm-5fvp

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0](https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0)
- [https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423](https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423)

## Related threats

- [CKEditor: Cross-site scripting (XSS) in the engine package](https://junglewise.ai/threats/cve-2026-116687-ckeditor-5-is-a-modern-javascript-rich-text-editor-with-an-mvc)
- [Drupal cross-site scripting in CKEditor WYSIWYG](https://junglewise.ai/threats/drupal-core-2026-013-the-drupal-project-uses-the-ckeditor-https-github-f5b3da40)
- [CKEditor 5 cross-site scripting in HTML Support](https://junglewise.ai/threats/cve-2026-28343-ckeditor-5-cross-site-scripting-in-html-support)
- [CKEditor 5 clipboard cross-site scripting](https://junglewise.ai/threats/cve-2024-45613-ckeditor-5-clipboard-cross-site-scripting)
- [CKEditor5 cross-site scripting in HTML embed](https://junglewise.ai/threats/cve-2022-48110-ckeditor5-cross-site-scripting-in-html-embed)