CVE-2026-28343: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28343 is a Cross-Site Scripting (XSS) vulnerability in the General HTML Support (GHS) feature of CKEditor 5, classified as CWE-79. It allows attackers to execute unauthorized JavaScript code by inserting specially crafted markup into editor instances configured with unsafe General HTML Support settings. The vulnerability affects @ckeditor/ckeditor5-html-support and ckeditor5 npm packages from version 29.0.0 up to (but not including) 47.6.0. It was published on March 4, 2026, and patched in version 47.6.0 released the same day. The CVSS v3.1 base score is 6.1–6.4 (Medium/Moderate), depending on the scoring source (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79) within CKEditor 5's General HTML Support plugin, which was introduced in v29.0.0. When the GHS feature is enabled and configured to permit unsafe markup (e.g., allowing arbitrary HTML elements or attributes without sanitization), an attacker can insert crafted HTML containing malicious JavaScript that is rendered and executed in the browser context. Exploitation requires that the target editor instance has GHS enabled with an overly permissive configuration — installations using the default or securely restricted GHS configuration are not affected. The vulnerability was responsibly disclosed by Emilio Kevin Jeongwoo Lee, Younsoung Kim, Minseok Kim, and Jinyeong Kim from ENKI Whitehat (GitHub Advisory).

Successful exploitation results in unauthorized JavaScript execution within the browser context of users who view or interact with content produced by the vulnerable editor. This can lead to session hijacking, credential theft, unauthorized data access (confidentiality impact), and content manipulation (integrity impact); availability is not directly impacted. Because the scope is marked as "Changed," the injected script can affect resources and users beyond the immediate editor context, potentially enabling stored XSS attacks that persist and execute for all subsequent viewers of the compromised content (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043–0.049%, placing it in the lower percentiles for near-term exploitation likelihood. Exploitation is conditional on the target application having GHS enabled with an unsafe configuration, which limits the attack surface to misconfigured deployments (GitHub Advisory).

1. Reconnaissance: Identify web applications using CKEditor 5 with the General HTML Support plugin enabled (versions 29.0.0–47.5.x). Look for editor instances that accept and render raw HTML input from users.
2. Assess GHS configuration: Determine whether the target editor's GHS configuration permits unsafe markup — for example, allowing arbitrary HTML tags or event handler attributes (e.g., onmouseover, onerror) without sanitization.
3. Craft malicious markup: Prepare a payload exploiting the permissive GHS configuration, such as an HTML element with an inline event handler: <img src=x onerror="alert(document.cookie)"> or a <script> tag if permitted by the configuration.
4. Insert payload: Submit the crafted markup into the editor (e.g., via a content submission form, comment field, or collaborative editing session) where it will be stored or reflected.
5. Trigger execution: When another user (or an administrator) views the content rendered by the vulnerable editor, the injected JavaScript executes in their browser context, enabling session theft, credential harvesting, or further attacks (GitHub Advisory, CKEditor Release).

• Network: Unusual HTTP requests containing HTML event handler attributes (e.g., onerror=, onload=, onmouseover=) or <script> tags in POST body parameters destined for CKEditor-powered endpoints.
• Logs: Web server or application logs showing submission of content with inline JavaScript patterns (e.g., javascript:, onerror=, <script>) to editor content endpoints.
• File System / Database: Stored editor content in the database containing unexpected <script> tags, javascript: URIs, or HTML event handler attributes in fields managed by CKEditor 5.
• Browser/Client: Unexpected JavaScript execution or network requests originating from pages rendering CKEditor content, particularly to external domains not associated with the application.

Upgrade to CKEditor 5 version 47.6.0 or later, which contains the security fix for both the ckeditor5 and @ckeditor/ckeditor5-html-support npm packages (CKEditor Release). As a workaround for organizations unable to patch immediately, review and restrict the General HTML Support configuration to explicitly disallow unsafe markup, event handler attributes, and <script> tags — refer to the Security section of the CKEditor 5 documentation for guidance on safe GHS configuration. Additionally, limit editor access to trusted users and consider disabling the General HTML Support feature entirely if it is not required for your use case (GitHub Advisory).

CKEditor published a security advisory and release notes for v47.6.0 acknowledging the vulnerability and crediting the ENKI Whitehat research team for responsible disclosure (CKEditor Release). Red Hat tracked the issue via Bugzilla (Bug 2444907) and assigned it medium severity (Red Hat Bugzilla). Tenable added detection coverage via Nessus plugins 301533 and 301995. Community and media coverage has been limited, consistent with the conditional nature of the vulnerability and absence of active exploitation.