CVE-2026-126207

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrubcss checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses,...

GHSA-M3X9-938Q-5767 Loofah: CSS url() sanitization bypass via escaped parentheses

Summary Loofah::HTML5::Scrub.scrubcss rejected any property whose top-level Crass tokens included a :url or :badurl, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrubcss rebuilt each property it emitted identifiers with...

CVE-2026-126207

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrubcss checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses,...

npm: odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

npm: odf-kit: HTML injection leading to XSS in odtToHtml and odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.6.0, 0.14.2...

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

CKEditor 45.x < 47.7.4 / 48.x < 48.5.1 XSS

The version of CKEditor included on the remote web host is 45.x prior to 47.7.4, or 48.x prior to 48.5.1. It is, therefore, affected by a cross-site scripting XSS vulnerability. The CKEditor 5 engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the "es-toolkit" library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

UBUNTU-CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5, a JavaScript rich-text editor, is vulnerable to Cross-site scripting (XSS) in its engine package. The issue exists in versions 45.0.0 through 47.7.4 and 48.5.1 because the engine utilizes a vulnerable es-toolkit version. Attackers can trigger prototype-pollution behavior by providing ...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

EUVD-2026-111364

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

PT-2026-127753

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

CKEditor Ecosystem CKEditor 5 Cross-site Scripting Vulnerability

The CKEditor ecosystem contains a cross-site scripting vulnerability in versions 45.0.0 through 47.7.4 and 48.0.0 through 48.5.1 of CKEditor 5. This vulnerability stems from prototype pollution issues related to the es-toolkit version used by the engine; when processing incoming values for the...

PT-2026-127221

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions 45.0.0 through 47.7.3 CKEditor 5 versions 48.0.0 through 48.5.0 Description A prototype pollution issue exists in the es-toolkit library used by the engine. This occurs when the editor processes incoming style attribute...