Skip to content
OpenAdvisories

Package · npm

@ckeditor/ckeditor5-engine

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.1
    CVE-2026-116688

    CKEditor: Cross-site scripting (XSS) in the engine package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribu…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Low 3.1
    CVE-2026-116687

    CKEditor: Cross-site scripting (XSS) in the engine package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object conten…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 6.5
    CVE-2021-21391

    Regular expression Denial of Service in multiple packages

    CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. F…

    ckeditor ckeditor5 ckeditor3 @ckeditor/ckeditor5-engine Ubuntu npm