Advisory · CVE-2026-116688
CKEditor 5 prototype pollution through style attributes can execute attacker JavaScript
CKEditor 5 from 45.0.0 until 47.7.4 and from 48.0.0 until 48.5.1 uses a vulnerable es-toolkit version whose prototype pollution behavior can be reached while processing incoming style attribute values, so crafted editor content can cause unauthorized JavaScript execution in the browser. CVSS 3.1 8.1.
- Vendor
- CKEditor
- Product
- CKEditor 5
- Identifier / CWE
- CVE-2026-116688
CWE-79 - Action timing
- Immediate
Explain it like I’m five
The editor leans on a helper library that can be tricked into quietly rewriting the default settings every object inherits. Crafted content can poison those defaults while the editor processes styles, and the poisoned defaults turn into the attacker's JavaScript running in the page.
- 01Crafted content submitted
A low-privileged user submits editor content with style attribute values crafted to reach the vulnerable helper behavior.
- 02Editor processes styles
CKEditor's engine processes the incoming style values using the vulnerable es-toolkit version.
- 03Prototype polluted
The processing pollutes object prototypes in the page's JavaScript environment.
- 04Script executes
Per the advisory, the result is unauthorized JavaScript execution in the browser.
What happened
The CKEditor project published CVE-2026-116688 on October 27, 2026, rated high at CVSS 3.1 8.1 in its GitHub advisory: from 45.0.0 until 47.7.4 and from 48.0.0 until 48.5.1, the CKEditor 5 engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while the editor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. The vendor record classifies the weakness as CWE-79.
The issue is fixed in CKEditor 5 versions 47.7.4 and 48.5.1. Because CKEditor is embedded in a large number of web applications, the vulnerable copy is usually a bundled dependency of a host application rather than a standalone install.
What to do
- Inventory web applications that bundle CKEditor 5, including vendor products and content management systems, and note the editor version.
- Update CKEditor 5 to 47.7.4 or 48.5.1 or later, matching the major branch in use, and redeploy the host applications.
- Until updated, treat rich-text content from untrusted users as active content: keep server-side sanitization in place and avoid relaxing style attribute allowlists.
- Review stored content for crafted style attribute payloads where editor input is accepted from low-privileged users.
- Verify the deployed editor version in the built application assets after updating.
Management note
Editor libraries sit in the content path of thousands of applications, so a flaw here is a supply chain patch event. Track CKEditor as a named dependency in your software inventory rather than letting it hide inside a CMS or vendor bundle.