ckeditor5 vulnerabilities and fixes

Recent CVEs affecting ckeditor5, with upgrade or downgrade steps. 3 tracked.

ckeditor5 has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-05. Highest priority: CVE-2024-45613 (score 32/100).

• CVE-2026-28343 MEDIUM 6.4 UPGRADE CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
• CVE-2025-61261 MEDIUM 5.4 DOWNGRADE DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to
• CVE-2024-45613 MEDIUM 6.1 UPGRADE CKEditor 5 is a JavaScript rich-text editor

FAQ

How do I fix ckeditor5 vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ckeditor5 being exploited right now?

None of the tracked ckeditor5 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ckeditor5 CVE should I patch first?

CVE-2024-45613 currently ranks highest (32/100): CKEditor 5 is a JavaScript rich-text editor.

RSS feed for ckeditor5 · ← Back to latest CVEs