CKEditor 5 CVE-2026-116687

Exploitation requires that the embedding application has the General HTML Support (GHS) feature enabled AND is specifically configured to allow inserting object content; the advisory states this affects only such installations, so default or GHS-disabled deployments are not exposed. The attacker must be able to supply markup that the editor processes (reflected by PR:L), and the trigger is crafted markup involving disallowed object/data: URI content that the patch now filters. Key limiting factors: the vulnerable GHS object configuration is non-default, attack complexity is high per the vendor vector, and critically the resulting JavaScript executes in a browser context isolated from the origin of the embedding application - which the vendor models as no confidentiality impact and only low integrity impact, materially reducing realistic damage compared to classic same-origin stored XSS.

All available signals point to a genuinely low-priority issue rather than a high-severity flaw dressed down by scoring. The vendor CVSS:3.1 base score is 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable but high attack complexity, requiring some privilege, with no confidentiality or availability impact and only low integrity impact because the injected JavaScript runs in a browser context isolated from the embedding application's origin. The vuln.today decision label is 'monitor', consistent with that low score. No EPSS probability was supplied, there is no CISA KEV listing (not actively exploited), and the input contains only vendor advisory, commit, and release references - no public exploit identified at time of analysis. The main caveat is configuration dependence: exploitation is confined to installations where General HTML Support is enabled AND specifically configured to allow object content, so raw CVSS network reachability overstates real exposure for the typical default deployment. No signals conflict; the chief missing data points are EPSS and any independent exploitability assessment, both absent from the input.

In an application embedding CKEditor 5 where General HTML Support is enabled and configured to permit inserting objects, an actor able to supply editor content submits specially crafted markup (for example an object referencing a disallowed data: URI). When the editor processes that content, attacker-controlled JavaScript executes, though in a browser context isolated from the embedding application's origin. No public exploit code is identified in the provided data, and the AC:H rating reflects the specific non-default configuration required.