Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@ckeditor/ckeditor5-engine

3 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
49.1.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
49.1.0 (Nov 4, 2026), the latest release
Advisories
3 · 1 high, 1 medium, 1 low
Weekly downloads
1.5M
Dependents
315
Releases
500+ since 47.5.0 (Feb 11, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-116688
    Affects 47.5.0-alpha.3 to 47.7.3 (47.7.4 is outside it); 48.0.0 to 48.5.0 (48.5.1 is outside it)
  • CVE-2026-116687
    Affects 47.5.0-alpha.3 to 47.7.3 (47.7.4 is outside it); 48.0.0 to 48.5.0 (48.5.1 is outside it)
  • CVE-2021-21391
    Affects 0.0.0-internal-20260224.0 to 0.0.0-nightly-next-20260907.0 (47.5.0-alpha.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 3

  • CKEditor: Cross-site scripting (XSS) in the engine package

    Affected: from 45.0.0, fixed in 47.7.4; from 48.0.0, fixed in 48.5.1.

    Fixed in 47.7.4 (released Sep 16, 2026, 41 days before disclosure) and 48.5.1 (released Sep 16, 2026, 41 days before disclosure).

    The latest release, 49.1.0, is not affected.

    38% of @ckeditor/ckeditor5-engine downloads last week were affected versions (784K).

  • CKEditor: Cross-site scripting (XSS) in the engine package

    Affected: from 29.0.0, fixed in 47.7.4; from 48.0.0, fixed in 48.5.1.

    Fixed in 47.7.4 (released Sep 16, 2026, 41 days before disclosure) and 48.5.1 (released Sep 16, 2026, 41 days before disclosure).

    The latest release, 49.1.0, is not affected.

    75% of @ckeditor/ckeditor5-engine downloads last week were affected versions (1.5M).

  • CVE-2021-21391Medium 6.5

    Regular expression Denial of Service in multiple packages

    Affected: fixed in 27.0.0.

    Fixed in 47.5.0 (released Feb 11, 2026, 1749 days after disclosure, the advisory names 27.0.0, which was never published).

    The latest release, 49.1.0, is not affected.

    2.1% of @ckeditor/ckeditor5-engine downloads last week were affected versions (43.2K).