Executive brief
CKEditor 5 is a popular rich-text editor used on many websites to allow users to create and format content. A cross-site scripting (XSS) vulnerability in its HTML Support feature could allow attackers to inject malicious JavaScript code that executes in the context of a website, potentially stealing user credentials or session data if the editor is misconfigured to accept unsafe HTML markup.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the General HTML Support feature of CKEditor 5 (CWE-79). The vulnerability can be triggered when an attacker inserts specially crafted markup into an editor instance that has General HTML Support enabled with an unsafe configuration allowing unsafe markup insertion. The attack requires low privilege level and does not require user interaction, but only affects installations where General HTML Support is explicitly enabled and misconfigured. Attackers can execute arbitrary JavaScript code in the context of the affected website. The vulnerability was patched in version 47.6.0 and above; users should upgrade immediately or implement secure General HTML Support configuration as recommended in the advisory.
Affected products
- CKEditor CKEditor 5 29.0.0 to 47.5.x
- CKEditor ckeditor5-html-support 29.0.0 to 47.5.x
Timeline
- 2026-03-04: disclosed: Vulnerability published via GHSA-jrqm-vmqc-gm93
- 2026-03-04: patched: Fix available in version 47.6.0 and above