Threat Investigation
Request a demo

CVE-2026-28343

Medium

Description

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

SeverityMedium
CVSS6.4
Exploit probability—
ProductCkeditor5
PublishedMar 5, 2026
First seenMar 5, 2026
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • ckeditor ckeditor547.6.0 or later
  • @ckeditor/ckeditor5-html-support47.6.0 or later
  • ckeditor547.6.0 or later

Affected products

ProductAffected versionsFixed in
ckeditor ckeditor5v < 47.6.047.6.0
@ckeditor/ckeditor5-html-supportnpm29.0.0 ≤ v < 47.6.047.6.0
ckeditor5npm29.0.0 ≤ v < 47.6.047.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.