Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ckeditor5

5 known vulnerabilities (1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
49.1.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
49.1.0 (Nov 4, 2026), the latest release
Advisories
5 · 1 high, 2 medium, 2 low
Weekly downloads
1.2M
Dependents
50
Releases
500+ since 47.5.0 (Feb 11, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-116688
    Affects 47.5.0-alpha.3 to 47.7.3 (47.7.4 is outside it); 48.0.0 to 48.5.0 (48.5.1 is outside it)
  • CVE-2026-116687
    Affects 47.5.0-alpha.3 to 47.7.3 (47.7.4 is outside it); 48.0.0 to 48.5.0 (48.5.1 is outside it)
  • CVE-2026-28343
    Affects 47.5.0-alpha.3 to 47.6.0-alpha.9 (47.6.0 is outside it)
  • CVE-2025-58064
    No published release is affected
    No published release is affected
  • CVE-2024-45613
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 5

  • CKEditor: Cross-site scripting (XSS) in the engine package

    Affected: from 45.0.0, fixed in 47.7.4; from 48.0.0, fixed in 48.5.1.

    Fixed in 47.7.4 (released Sep 16, 2026, 41 days before disclosure) and 48.5.1 (released Sep 16, 2026, 41 days before disclosure).

    The latest release, 49.1.0, is not affected.

    26% of ckeditor5 downloads last week were affected versions (409.2K).

  • CKEditor: Cross-site scripting (XSS) in the engine package

    Affected: from 29.0.0, fixed in 47.7.4; from 48.0.0, fixed in 48.5.1.

    Fixed in 47.7.4 (released Sep 16, 2026, 41 days before disclosure) and 48.5.1 (released Sep 16, 2026, 41 days before disclosure).

    The latest release, 49.1.0, is not affected.

    81% of ckeditor5 downloads last week were affected versions (1.3M).

  • CVE-2026-28343Medium 6.4

    CKEditor: Cross-site scripting (XSS) in the HTML Support package

    Affected: from 29.0.0, fixed in 47.6.0.

    Fixed in 47.6.0 (released Mar 4, 2026, 1 day before disclosure).

    The latest release, 49.1.0, is not affected.

    69% of ckeditor5 downloads last week were affected versions (1.1M).

  • CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

    Affected: from 46.0.0, fixed in 46.0.3; from 44.2.0, fixed in 45.2.2.

    Fixed in 47.5.0 (released Feb 11, 2026, 161 days after disclosure, the advisory names 45.2.2, which was never published).

    The latest release, 49.1.0, is not affected.

    15% of ckeditor5 downloads last week were affected versions (231K).

  • CVE-2024-45613Medium 5.1

    CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

    Affected: from 40.0.0, fixed in 43.1.1.

    Fixed in 47.5.0 (released Feb 11, 2026, 504 days after disclosure, the advisory names 43.1.1, which was never published).

    The latest release, 49.1.0, is not affected.

    24% of ckeditor5 downloads last week were affected versions (373.8K).