CKEditor: Cross-site scripting (XSS) in the engine package - @ckeditor/ckeditor5-engine - GHSA-rh54-vffm-5fvp

Description

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values.

Recommendation

Update the @ckeditor/ckeditor5-engine package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 48.0.0, < 48.5.1

  >= 45.0.0, < 47.7.4**

• Patched version(s): **48.5.1

  47.7.4**

References

• GHSA-rh54-vffm-5fvp
• CVE-2026-116688
• CWE-79
• CAPEC-310