CKEditor 5 v49.0.1 and LTS v47.7.6 Release Highlights: Security Fixes

We have released a CKEditor 5 security update that resolves three cross-site scripting (XSS) vulnerabilities. In each case, a specific editor configuration could allow unauthorized JavaScript to run in the editor. Two of the issues are in the Track Changes plugin and one is in CKEditor AI, and fixed versions are available now across the standard and LTS release lines.

Not every installation is affected. Each of the three vulnerabilities depends on a particular combination of features or plugins being enabled, and the sections below describe those conditions so you can check your own configuration. Separately, we have refreshed our on-premises images to pick up a security fix in the Node.js runtime they bundle.

#Track Changes with color pluginsUPDATED

This issue (GHSA-2x29-fwvw-5g7x) affects editors that run Track Changes together with a feature that applies a color or background color to content, such as the Font Color or Font Background Color plugins. When both are in place, a specially crafted suggestion added to the document can trigger the vulnerability. Installations that do not pair Track Changes with a color feature are not affected.

#Track Changes preview of final contentUPDATED

This issue (GHSA-xh7q-269v-94j2) applies only when the editor is configured to permit unsafe markup in its output, for example through HTML Embed or a non-default General HTML Support configuration. It can then be triggered while the Preview final content feature of Track Changes is displaying the final content.

#CKEditor AI chatUPDATED

This issue, GHSA-vjh8-qw64-q282 applies only when CKEditor AI is enabled. It can be triggered by a crafted message sent to the AI chat, and when the model is steered into returning a specific output, for example by means of a prompt injection.

#On-premisesUPDATED

Separately from the releases above, our on-premises products have received updates that address a security issue in the Node.js runtime they bundle, rather than in our own product code. The following five products have new versions:

• Real-time Collaboration 5.5.1

• AI 5.5.1

• CKBox 2.13.3

• DOCX Converter 1.24.5

• PDF Converter 2.0.11

Each updates the bundled runtime to Node.js 24.22.1, the latest security release on the Node.js 24 LTS line, which resolves several issues in Node.js itself including CVE-2026-111497. We recommend updating to the latest versions to keep your deployment secure.

#Quick links for CKEditor v49.0.1 and v48.5.3

• Download the latest version of CKEditor: CDN, npm or zip packages.

• CKEditor 5 Builder

• CKEditor 5 AI skills for coding agents

• CKEditor 5 installation guides

• CKEditor 5 documentation

• CKEditor 5 changelog

• CKEditor 5 pricing 

• CKEditor 5 license

• Getting support for CKEditor 5 

• Report issues on GitHub repository

#Quick links for CKEditor LTS v47.7.6

• CKEditor 5 Long-term Support Edition

• CKEditor 5 LTS Builder 

• CKEditor 5 LTS installation guides

• CKEditor 5 LTS documentation

• CKEditor 5 LTS changelog

#Interested in LTS?

If your organization values long-term stability over continuous updates, the CKEditor 5 LTS Edition may be worth exploring. You can learn more about it on our introduction post or contact our sales team to obtain a license.

#Learn more about previous CKEditor 5 versions

• CKEditor 5 v49.0.0 Release Highlights: Shadow DOM Support, Refreshed Theme, Trusted Types Support

• CKEditor 5 v48.5.1 and LTS v47.7.4 Release Highlights: Security Fixes

• CKEditor 5 v48.4.0 Release Highlights: AI Context Library and Image Understanding

• CKEditor 5 v48.3.0 Release Highlights: Programmatic API for CKEditor AI

• CKEditor 5 v48.2.0 Release Highlights: AI Chat Improvements, Media Embed, and More

• CKEditor 5 v47.7.0 LTS Release Highlights: Entering the Maintenance Phase

• Introducing the CKEditor 5 Long-Term Support Edition