@ckeditor/ckeditor5-engine
npm3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @ckeditor/ckeditor5-enginepage 1 of 1
- CVE-2021-21391MEDIUMCVSS 6.5EG 6.5fixed in 27.0.02021-04-29
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and…
- CVE-2026-116687LOWCVSS 3.1EG 3.1fixed in 47.7.4 or 48.5.1, by version range2026-10-27
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to…
- CVE-2026-116688HIGHCVSS 8.1EG 8.1fixed in 47.7.4 or 48.5.1, by version range2026-10-27
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes in…
Check whether @ckeditor/ckeditor5-engine is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @ckeditor/ckeditor5-engine CVEs against the assets you own.
Book a Demo →