CKEditor 5 changelog

This is the CKEditor 5 changelog guide. Here you will find information about the most important changes introduced in the release, new features, and bug fixes.

Information about both major and minor breaking changes is available, too, if the release introduces them. You can read more about breaking changes in CKEditor 5 in the Versioning policy guide.

You can find more information about each release in the blog posts linked at the start of each entry.

This guide provides the changelog information for the 3 latest releases of CKEditor 5. For older releases, refer to the release notes on GitHub.

We are excited to announce the release of CKEditor 5 v47.7.5.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

• utils: Fixed an initialization failure in Safari 27 on Intel Macs by working around a regression in the browser’s implementation of String#substr(). Closes #20237.

  Affected Safari builds return the entire string instead of an empty string when String#substr() is called with a negative length. For event names without a namespace separator, this caused an event node to reference itself as a child, leading to infinite recursion and a stack overflow when collecting callbacks. The editor no longer relies on String#substr() for this operation.

  Thanks to @ld3nl.

CKEditor 5 v47.7.4 is now available.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.

The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.

The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

You can read more details in the relevant security advisories and contact us if you have more questions.

Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.

• engine: Improved data: URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addresses GHSA-v6mg-96c6-gmpq.

• Updated the es-toolkit dependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described in GHSA-rh54-vffm-5fvp.

We are happy to announce the release of CKEditor 5 v47.7.3.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

The release addresses vulnerabilities identified in the protobuf.js package, used within our @ckeditor/ckeditor5-operations-compressor package for real-time collaboration.

Our analysis confirms that vulnerabilities do not affect CKEditor 5.

This release primarily aims to ensure that our customers using real-time collaboration features do not encounter unnecessary security alerts from their scanning tools. We are committed to maintaining the highest security standards, and this update reflects our ongoing efforts to safeguard user environments proactively.