CVE-2026-28343
published 2026-03-05CVE-2026-28343: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.27%
18.3th percentile
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ckeditor | ckeditor5 | < 47.6.0 | 47.6.0 |
| ckeditor | ckeditor5 | — | — |
| ckeditor | ckeditor5 | >= 29.0.0 < 47.6.0 | 47.6.0 |
| ckeditor | ckeditor5-html-support | >= 29.0.0 < 47.6.0 | 47.6.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-28343: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
osv·2026-03-05·CVSS 6.1
CVE-2026-28343 [MEDIUM] CVE-2026-28343: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.
OSV
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
osv·2026-03-04
CVE-2026-28343 [MEDIUM] CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
### Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.
This vulnerability affects only installations where the editor configuration meets the following criteria:
* [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html) is enabled,
* General HTML Support configuration allows inserting unsafe markup (see [Security](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html#security) section t
GHSA
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
ghsa·2026-03-04
CVE-2026-28343 [MEDIUM] CWE-79 CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
### Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.
This vulnerability affects only installations where the editor configuration meets the following criteria:
* [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html) is enabled,
* General HTML Support configuration allows inserting unsafe markup (see [Security](https://ckeditor.com/docs/ckeditor5/latest/features/html/general-html-support.html#security) section t
No detection rules found.
No public exploits indexed.
2026-03-05
Published