Is CVE-2026-116687 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116687?

CVE-2026-116687 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-116687

Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object content. Processing that content can execute attacker-controlled JavaScript in a browser context isolated from the origin of the application embedding the editor. This issue is fixed in versions 47.7.4 and 48.5.1.