PT-2026-23086 · Ckeditor · Ckeditor 5

Emilio Kevin + 4 · Publicado 2026-03-04 · Atualizado 2026-03-06 · CVE-2026-28343

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 47.6.0

Description CKEditor 5, a JavaScript rich-text editor, contains a cross-site scripting (XSS) issue within the General HTML Support feature. This issue arises from the insertion of specially crafted markup, potentially leading to unauthorized JavaScript code execution. The vulnerability is triggered when the editor is configured to use an unsafe General HTML Support configuration. The issue affects installations where General HTML Support is enabled and configured to allow unsafe markup.

Recommendations Versions prior to 47.6.0 should be updated to version 47.6.0 or later. Configure General HTML Support securely to prevent the acceptance of unsafe content.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-28343

GHSA-JRQM-VMQC-GM93

Produtos afetados

Ckeditor 5

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28343.json · Exploit
• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93 · Aviso do Fabricante
• https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0 · Nota
• https://github.com/ckeditor/ckeditor5 · Nota
• https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0 · Nota
• https://twitter.com/cyberbivash/status/2029657049127129425 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-28343 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28343 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-28343 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2029654695409553554 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-28343 · Nota de Segurança
• https://t.me/CVEtracker/46486 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029725438029758924 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28343 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jrqm-vmqc-gm93 · Aviso do Fabricante