Description
A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration.
Recommendation
Update the @ckeditor/ckeditor5-html-support package to the latest compatible version. Followings are version details:
- Affected version(s): >= 29.0.0, < 47.6.0
- Patched version(s): 47.6.0
References
Could your website be exposed too?
SmartScanner can check your website for CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343
- CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support - CVE-2022-31175
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - ckeditor5 - CVE-2025-58064
You might also like:
See something that needs correcting? Let us knowUpdated March 19, 2026