Repository navigation
fix(deps): bump ckeditor5 from ^47.6.2-alpha.0 to v47.7.4 (stable5.13) - #13962
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
requested review from
ChristophWurst,
GretaD and
kesselb
as code owners
October 28, 2026 04:04
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/stable5.13-npm-ckeditor5-vulnerability
branch
from
November 2, 2026 13:21
26abada to
6282d78
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/stable5.13-npm-ckeditor5-vulnerability
branch
from
November 5, 2026 18:45
6282d78 to
374ea8d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
47.6.2→47.7.4CKEditor: Cross-site scripting (XSS) in the engine package
CVE-2026-116688 / GHSA-rh54-vffm-5fvp
More information
Details
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the
es-toolkitlibrary used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incomingstyleattribute values.The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.
Patches
The problem has been recognized and patched. The fix will be available in version
48.5.1(and above) and47.7.4(LTS).For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
CKEditor: Cross-site scripting (XSS) in the engine package
CVE-2026-116687 / GHSA-v6mg-96c6-gmpq
More information
Details
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.
Patches
The problem has been recognized and patched. The fix will be available in version
48.5.1(and above) and47.7.4(LTS).For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
CKEditor: Cross-site scripting (XSS) in the engine package
CVE-2026-116688 / GHSA-rh54-vffm-5fvp
More information
Details
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the
es-toolkitlibrary used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incomingstyleattribute values.The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.
Patches
The problem has been recognized and patched. The fix will be available in version
48.5.1(and above) and47.7.4(LTS).For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
CKEditor: Cross-site scripting (XSS) in the engine package
CVE-2026-116687 / GHSA-v6mg-96c6-gmpq
More information
Details
Impact
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 engine. This vulnerability could be triggered by inserting specially crafted markup under a specific General HTML Support configuration that allows inserting objects, leading to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.
This vulnerability affects only installations where General HTML Support is enabled and configured to allow the affected HTML content.
Patches
The problem has been recognized and patched. The fix will be available in version
48.5.1(and above) and47.7.4(LTS).For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
ckeditor/ckeditor5 (ckeditor5)
v47.7.4Compare Source
CKEditor 5 v47.7.4 is now available.
Release highlights
This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.
The first vulnerability (
GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in thees-toolkitlibrary used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incomingstyleattribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.The second vulnerability (
GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.You can read more details in the relevant security advisories and contact us if you have more questions.
Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.
Bug fixes
data:URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addressesGHSA-v6mg-96c6-gmpq.Other changes
es-toolkitdependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described inGHSA-rh54-vffm-5fvp.Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.3Compare Source
We are happy to announce the release of CKEditor 5 v47.7.3.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
v47.7.2Compare Source
We are happy to announce the release of CKEditor 5 v47.7.2.
Release highlights
The release addresses vulnerabilities identified in the
protobuf.jspackage, used within our@ckeditor/ckeditor5-operations-compressorpackage for real-time collaboration.Our analysis confirms that vulnerabilities do not affect CKEditor 5.
This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.
Released packages
Check out the Versioning policy guide for more information.
Released packages (summary)
Other releases:
Configuration
📅 Schedule: (in timezone Europe/Vienna)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.