CVE-2026-28343

Katalog CVE

CVSS 6.1 · Medium EPSS 0,36%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ckeditor5. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93 mitigasi · advisory vendor
• https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0
• https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0 release notes