This vulnerability exists in CKEditor 5’s General HTML Support feature, where an attacker can insert specially crafted markup that triggers a cross‑site scripting flaw. The injection leads to unauthorized JavaScript code execution within the context of a page hosting the editor. Such execution can facilitate data theft, session hijacking or further compromise of the hosting application.

CKEditor 5 versions from 29.0.0 up to, but not including, 47.6.0 are affected. The flaw is triggered when the editor instance is configured with the unsafe General HTML Support option. The fix was introduced in CKEditor 5 version 47.6.0, which securely sanitises the passed content.

The CVSS score of 6.4 rates the flaw as medium severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web page that references an attacker‑crafted CKEditor instance with General HTML Support enabled; content from an untrusted source can be injected, resulting in client‑side JavaScript execution. While the risk for an unpatched system is moderate, the low exploit probability suggests that attackers will invest effort only if the vulnerability is publicly known and the target uses a vulnerable version.