CKEditor 5 changelog

This is the CKEditor 5 changelog guide. Here you will find information about the most important changes introduced in the release, new features, and bug fixes.

Information about both major and minor breaking changes is available, too, if the release introduces them. You can read more about breaking changes in CKEditor 5 in the Versioning policy guide.

You can find more information about each release in the blog posts linked at the start of each entry.

This guide provides the changelog information for the 3 latest releases of CKEditor 5. For older releases, refer to the release notes on GitHub.

CKEditor 5 v47.7.6 is now available.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

This release addresses three cross-site scripting (XSS) vulnerabilities, two in the Track Changes plugin and one in CKEditor AI. Under specific conditions, described below, each of them could lead to unauthorized JavaScript code execution.

The first vulnerability (GHSA-2x29-fwvw-5g7x) can be triggered by inserting a specially crafted suggestion into the editor. It affects only installations where Track Changes is enabled together with a feature that allows assigning a color or background color to an element, such as the Font Color or Font Background Color plugins.

The second vulnerability (GHSA-xh7q-269v-94j2) affects the “Preview final content” feature of Track Changes and can be triggered when the final content preview is displayed. It applies only to installations that use a plugin allowing unsafe markup in the editor data output, such as General HTML Support with a non-default configuration or HTML Embed.

The third vulnerability (GHSA-vjh8-qw64-q282) can be triggered by inserting a specially crafted message into the CKEditor AI chat. It affects only installations where CKEditor AI is enabled, and exploitation requires tricking the model into returning specific output, for example through prompt injection.

You can read more details in the relevant security advisories and contact us if you have more questions.

We would like to thank Won Yong Jeon for reporting these vulnerabilities.

• track-changes: The final content preview now renders the content using the editing pipeline instead of the data pipeline, so the preview looks and behaves like the content in the read-only editor.
• The development environment for CKEditor 5 now requires Node v26.10.

We are excited to announce the release of CKEditor 5 v47.7.5.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

• utils: Fixed an initialization failure in Safari 27 on Intel Macs by working around a regression in the browser’s implementation of String#substr(). Closes #20237.

  Affected Safari builds return the entire string instead of an empty string when String#substr() is called with a negative length. For event names without a namespace separator, this caused an event node to reference itself as a child, leading to infinite recursion and a stack overflow when collecting callbacks. The editor no longer relies on String#substr() for this operation.

  Thanks to @ld3nl.

CKEditor 5 v47.7.4 is now available.

ℹ️ Long Term Support Edition release: This is a CKEditor 5 Long Term Support (LTS) Edition release, available only to LTS subscribers. It delivers security and critical maintenance fixes for the v47 line. Visit documentation to learn more.

This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.

The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.

The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

You can read more details in the relevant security advisories and contact us if you have more questions.

Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.

• engine: Improved data: URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addresses GHSA-v6mg-96c6-gmpq.

• Updated the es-toolkit dependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described in GHSA-rh54-vffm-5fvp.