CKEditor 5 changelog

This is the CKEditor 5 changelog guide. Here you will find information about the most important changes introduced in the release, new features, and bug fixes.

Information about both major and minor breaking changes is available, too, if the release introduces them. You can read more about breaking changes in CKEditor 5 in the Versioning policy guide.

You can find more information about each release in the blog posts linked at the start of each entry.

This guide provides the changelog information for the 3 latest releases of CKEditor 5. For older releases, refer to the release notes on GitHub.

We are excited to announce the release of CKEditor 5 v48.5.2.

• utils: The EmitterMixinConstructor, ObservableMixinConstructor and DomEmitterMixinConstructor types no longer resolve to undefined in projects that compile with the strictNullChecks option disabled. Closes #20238.

  Thanks to @ld3nl.

• utils: Fixed an initialization failure in Safari 27 on Intel Macs by working around a regression in the browser’s implementation of String#substr(). Closes #20237.

  Affected Safari builds return the entire string instead of an empty string when String#substr() is called with a negative length. For event names without a namespace separator, this caused an event node to reference itself as a child, leading to infinite recursion and a stack overflow when collecting callbacks. The editor no longer relies on String#substr() for this operation.

  Thanks to @ld3nl.

CKEditor 5 v48.5.1 is now available.

This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.

The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.

The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

You can read more details in the relevant security advisories and contact us if you have more questions.

Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.

• engine: Improved data: URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addresses GHSA-v6mg-96c6-gmpq.

• Updated the es-toolkit dependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described in GHSA-rh54-vffm-5fvp.

We are happy to announce the release of CKEditor 5 v48.5.0.

AI Chat now better understands the General HTML Support configuration. The editor shares which additional HTML elements, classes, styles, and attributes are allowed in the content, so the AI produces replies that respect your content rules. Read more about how the AI adapts to your setup in the feature understanding guide.

We also made the Context Library available directly to users in the chat. Enable the new config.ai.chat.context.contextLibrary option to add the library to the “Add context” menu of AI Chat, where users attach a context to the conversation like any other resource. The list shows only the contexts the user token grants access to, and once the first message is sent, the context stays attached for the whole conversation. Learn more about offering contexts in the AI Chat picker.

AI-generated suggestions can already advertise their origin while they are open in the document. With this release, the same information can be surfaced in Revision History: revisions that include suggestions created with AI features can be visually marked as AI-assisted. Reviewers can tell at a glance which saved revisions involved AI, even after the suggestions were accepted.

The feature is opt-in and disabled by default. Enable it with the new config.revisionHistory.showAISource option. See the documentation for details.

We are making table column resizing more predictable. Columns no longer shrink by a few pixels when resizing starts while the editor content has a vertical scrollbar, and resizing the last column of a nested table by a resizer placed in a header cell no longer stretches that table to the full width of its parent table.

We also improved how table wrapper classes interact with the General HTML Support feature: the content-table and layout-table classes set on the <figure> element wrapping a content table are no longer preserved as arbitrary classes, keeping the output markup clean.

• ai: Introduced the DocumentCompare API, which captures a snapshot of the document, compares it with a processed version, and applies the resulting difference to the editor directly or as Track Changes suggestions.

• ai: Improved the AI agent’s understanding of the General HTML Support configuration. The agent now recognizes which additional HTML elements, classes, styles, and attributes are allowed in the content.

• ai: Changed AI Chat context items to match the behavior of file and link attachments. A context item can no longer be removed after the first message is sent, and its badge appears only next to that message.

• ai: Added a dedicated API method for attaching a Context Library item to the AI Chat context.

• revision-history: Added the config.revisionHistory.showAISource option for visually marking revisions that include changes created with AI features as AI-assisted, both in the revisions list and when comparing revisions.

• revision-history: Introduced the revisionHistory.showCommentHighlights configuration option for highlighting comment markers saved in revisions. This option is disabled by default.

  This option never highlights markers for removed or resolved comment threads because Revision History does not restore these comments automatically.

• collaboration-core, comments, track-changes: Fixed relative date labels such as “Today” and “Yesterday” to use calendar days instead of elapsed hours. An item created on the previous day is now labeled “Yesterday” regardless of how many hours have passed.
• collaboration-core, revision-history, track-changes: Fixed errors that occurred when opening the revision history viewer or using Track Changes data in integrations where AI features were registered on a context instead of an editor.
• ai: Improved error reports from AI features by including details from the point of failure. Previously, error tracking services did not receive these details.
• ai: Fixed an issue where AI Chat displayed outdated suggested changes while streaming a reply.
• collaboration-core: Fixed an issue where DocumentCompare produced inaccurate results when General HTML Support was configured to allow the data-id attribute.
• revision-history: Fixed an issue where RevisionTracker#saveRevision() modified the revision data object passed to it. Previously, reusing this object in multiple calls caused subsequent revisions to reuse the first revision’s identifier.
• revision-history: Fixed an issue where the revision viewer failed to open when the AI chat history feature was enabled.
• table: Fixed an issue where table columns shrank by a few pixels when resizing started while the editor content had a vertical scrollbar. Closes #20117.
• table: Fixed an issue where resizing the last column of a nested table using a resizer in a header cell stretched that table to the full width of its parent table.
• table: Fixed an issue where General HTML Support preserved the content-table and layout-table classes set on the <figure> element wrapping a content table as arbitrary classes.

• comments: Changed annotation activation for overlapping comments and suggestions to target the annotation displayed higher in the sidebar while keeping the other annotation accessible.