CKEditor 5: Cross-site scripting via prototype pollution in engine package
Summary
CKEditor 5 versions 45.0.0 to before 47.7.4 and 48.0.0 to before 48.5.1 use a vulnerable es-toolkit version. Prototype pollution can be triggered while the editor processes incoming style attribute values. An attacker who can submit crafted editor content can run unauthorized JavaScript in the browser of another user who opens it. The CVSS score is 8.1 (High).
Affected
- @ckeditor/ckeditor5-engine and ckeditor5 from 45.0.0 before 47.7.4
- @ckeditor/ckeditor5-engine and ckeditor5 from 48.0.0 before 48.5.1
- Applications that bundle their own CKEditor 5 copy
Fixed in
- 47.7.4 (LTS line)
- 48.5.1 (standard line) and later
Workaround
Unknown. No vendor-documented interim mitigation.
Exploitation
- Not known to be exploited in the wild.
- No public proof-of-concept known.
- EPSS 0.5 % (percentile 43). Not listed in CISA KEV.
Our recommendation
- Inventory all CKEditor 5 instances, including npm projects and bundled third-party applications.
- Upgrade to 47.7.4 (LTS) or 48.5.1 or later. Treat 45.x and 46.x as affected.
- For bundled applications, check the vendor's advisory for a fixed build.
- Prioritise internet-facing portals, multi-tenant systems and ticketing tools.
- Until patched, restrict who can submit editor content and sanitise HTML on the server before display.
- Re-check NVD and the GitHub advisory GHSA-rh54-vffm-5fvp for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rh54-vffm-5fvp github.com
- CKEditor 5 release v48.5.1 github.com
- CKEditor 5 release v47.7.4 github.com
- CKEditor blog: v48.5.1 and LTS v47.7.4 security fixes ckeditor.com
- Ubuntu CVE tracker ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:53.
Original description (NVD)
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.
NVD references (5)
- https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0
- https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423
- https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4
- https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1
- https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.