CVE-2026-28343

{"id": "CVE-2026-28343", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-03-05T20:16:16.017", "references": [{"url": "https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0."}, {"lang": "es", "value": "CKEditor 5 es un editor de texto enriquecido moderno de JavaScript con una arquitectura MVC. Antes de la versi\u00f3n 47.6.0, se ha descubierto una vulnerabilidad de cross-site scripting (XSS) en la funci\u00f3n de Soporte HTML General. Esta vulnerabilidad podr\u00eda activarse mediante la inserci\u00f3n de marcado especialmente dise\u00f1ado, lo que llevar\u00eda a la ejecuci\u00f3n no autorizada de c\u00f3digo JavaScript, si la instancia del editor utilizaba una configuraci\u00f3n insegura de Soporte HTML General. Este problema se ha corregido en la versi\u00f3n 47.6.0."}], "lastModified": "2026-03-17T18:39:49.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ckeditor:ckeditor5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6ADE9D9-13BD-491C-8B46-0A3D45582F03", "versionEndExcluding": "47.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}