CVE-2026-28343
Medium · 6.4CVSS
6.4
EPSS
0.4%
Published
Mar 5, 2026
CISA due date
—
The record
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @ckeditor/ckeditor5-html-support | 29.0.0 | 47.6.0 |
| npm | ckeditor5 | 29.0.0 | 47.6.0 |
Related vulnerabilities
- GHSA-jrqm-vmqc-gm93 CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package Same vulnerability
- CVE-2024-45613 CKEditor 5 is a JavaScript rich-text editor. Also affects ckeditor5
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79