CVE-2026-28343

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0
https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0	Release Notes
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-05 20:16

Updated : 2026-03-19 19:16

NVD link : CVE-2026-28343

Mitre link : CVE-2026-28343

CVE.ORG link : CVE-2026-28343

JSON object : View

Products Affected

ckeditor

ckeditor5

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-28343", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-03-05T20:16:16.017", "references": [{"url": "https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0."}, {"lang": "es", "value": "CKEditor 5 es un editor de texto enriquecido moderno de JavaScript con una arquitectura MVC. Antes de la versi\u00f3n 47.6.0, se ha descubierto una vulnerabilidad de cross-site scripting (XSS) en la funci\u00f3n de Soporte HTML General. Esta vulnerabilidad podr\u00eda activarse mediante la inserci\u00f3n de marcado especialmente dise\u00f1ado, lo que llevar\u00eda a la ejecuci\u00f3n no autorizada de c\u00f3digo JavaScript, si la instancia del editor utilizaba una configuraci\u00f3n insegura de Soporte HTML General. Este problema se ha corregido en la versi\u00f3n 47.6.0."}], "lastModified": "2026-03-19T19:16:20.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6ADE9D9-13BD-491C-8B46-0A3D45582F03", "versionEndExcluding": "47.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}