CKEditor: Cross-site scripting (XSS) in the engine package - ckeditor5

Description

A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values.

Recommendation

Update the ckeditor5 package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 48.0.0, < 48.5.1

  >= 45.0.0, < 47.7.4**

• Patched version(s): **48.5.1

  47.7.4**

References

• GHSA-rh54-vffm-5fvp
• CVE-2026-116688
• CWE-79
• CAPEC-310