CVE-2026-116688: CVE-2026-116688: DOM-based Cross-Site Scripting via Prototype Pollution in CKEditor 5 Engine

#security #cve #cybersecurity

CVE-2026-116688: DOM-based Cross-Site Scripting via Prototype Pollution in CKEditor 5 Engine

Vulnerability ID: CVE-2026-116688
CVSS Score: 8.1
Published: 2026-10-27

CVE-2026-116688 (GHSA-rh54-vffm-5fvp) is a high-severity Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 engine package (@ckeditor/ckeditor5-engine and the umbrella ckeditor5 package). The flaw originates from an upstream prototype pollution vulnerability in the es-toolkit dependency (versions prior to 1.52.0) used to parse and process inline HTML style attributes. When processing crafted CSS style declarations, the engine permits modification of Object.prototype, which alters downstream DOM conversion and sanitization checks to achieve arbitrary JavaScript execution in the browser context.

TL;DR

CKEditor 5 versions 45.0.0 through 47.7.3 (LTS) and 48.0.0 through 48.5.0 are vulnerable to DOM-based Cross-Site Scripting (XSS) due to prototype pollution in the underlying es-toolkit library during HTML style attribute processing. Upgrading CKEditor 5 to version 47.7.4 (LTS) or 48.5.1, or forcing es-toolkit resolution to >= 1.52.0, resolves the issue.

Technical Details

Vulnerability Class: Cross-Site Scripting via Prototype Pollution (CWE-79 / CWE-1321)
CVSS v3.1 Score: 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected Component: @ckeditor/ckeditor5-engine & es-toolkit (< 1.52.0)
Attack Vector: Network (Crafted HTML inline style attributes)
Impact: Arbitrary JavaScript execution in browser DOM context
Patched Versions: CKEditor 5 v47.7.4 (LTS) / v48.5.1 (es-toolkit 1.52.0)
Exploit Status: No known public weaponized exploits
CISA KEV Status: Not Listed

Affected Systems

ckeditor5
@ckeditor/ckeditor5-engine
@ckeditor/ckeditor5-autosave
@ckeditor/ckeditor5-ckbox
@ckeditor/ckeditor5-clipboard
@ckeditor/ckeditor5-core
@ckeditor/ckeditor5-editor-balloon
@ckeditor/ckeditor5-editor-classic
@ckeditor/ckeditor5-editor-decoupled
@ckeditor/ckeditor5-editor-inline
@ckeditor/ckeditor5-editor-multi-root
@ckeditor/ckeditor5-emoji
@ckeditor/ckeditor5-find-and-replace
@ckeditor/ckeditor5-html-embed
@ckeditor/ckeditor5-html-support
@ckeditor/ckeditor5-image
@ckeditor/ckeditor5-link
@ckeditor/ckeditor5-list
@ckeditor/ckeditor5-media-embed
@ckeditor/ckeditor5-mention
@ckeditor/ckeditor5-style
@ckeditor/ckeditor5-table
@ckeditor/ckeditor5-typing
@ckeditor/ckeditor5-ui
@ckeditor/ckeditor5-utils
@ckeditor/ckeditor5-watchdog
@ckeditor/ckeditor5-widget
@ckeditor/ckeditor5-word-count
es-toolkit
ckeditor5: >= 45.0.0, < 47.7.4 (Fixed in: 47.7.4)
ckeditor5: >= 48.0.0, < 48.5.1 (Fixed in: 48.5.1)
@ckeditor/ckeditor5-engine: >= 45.0.0, < 47.7.4 (Fixed in: 47.7.4)
@ckeditor/ckeditor5-engine: >= 48.0.0, < 48.5.1 (Fixed in: 48.5.1)

Code Analysis

Commit: 4d9c5bb

Changelog for v48.5.1. Upgrades es-toolkit from 1.45.1 to 1.52.0.

File: packages/ckeditor5-engine/package.json
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@ckeditor/ckeditor5-utils": "workspace:*",
-    "es-toolkit": "1.45.1"
+    "es-toolkit": "1.52.0"
   },

Commit: a750e38

Changelog for v47.7.4. Upgrades es-toolkit from 1.39.5 to 1.52.0 in LTS branch.

File: packages/ckeditor5-engine/package.json
@@ -25,7 +25,7 @@
   "main": "src/index.ts",
   "dependencies": {
     "@ckeditor/ckeditor5-utils": "workspace:*",
-    "es-toolkit": "1.39.5"
+    "es-toolkit": "1.52.0"
   },

Mitigation Strategies

Upgrade CKEditor 5 packages (ckeditor5 and all @ckeditor/* packages) to version 48.5.1 (main branch) or 47.7.4 (LTS branch).
Apply package manager dependency overrides (overrides in npm/pnpm or resolutions in Yarn) to force es-toolkit to version >= 1.52.0 when immediate CKEditor upgrades are not feasible.
Implement strict server-side HTML and CSS sanitization to strip invalid CSS property names and prototype keywords (__proto__, constructor, prototype) from inline style attributes prior to persistence.
Deploy a restrictive Content Security Policy (CSP) header disabling unsafe-inline and unsafe-eval script execution.

Remediation Steps:

Audit project lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) using npm ls es-toolkit to identify versions of es-toolkit prior to 1.52.0.
Run npm install ckeditor5@^48.5.1 @ckeditor/ckeditor5-engine@^48.5.1 (or @^47.7.4 for LTS) and update all installed @ckeditor/* plugins to matching versions.
If using custom builds or locked versions, configure overrides / resolutions in package.json for "es-toolkit": "^1.52.0" and reinstall dependencies.
Rebuild and redeploy all client-side web bundles containing CKEditor 5 assets.

References

Read the full report for CVE-2026-116688 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community