Skip to content

build(deps): bump ckeditor5 from 48.4.0 to 48.5.1 in /core/plugins/editors/ckeditor5/build - #1968

Closed
dependabot[bot] wants to merge 1 commit into
2.4-mainfrom
dependabot/npm_and_yarn/core/plugins/editors/ckeditor5/build/ckeditor5-48.5.1
Closed

dependabot[bot] wants to merge 1 commit into
2.4-mainfrom
dependabot/npm_and_yarn/core/plugins/editors/ckeditor5/build/ckeditor5-48.5.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps ckeditor5 from 48.4.0 to 48.5.1.

Release notes

Sourced from ckeditor5's releases.

v48.5.1

CKEditor 5 v48.5.1 is now available.

Release highlights

This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.

The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.

The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

You can read more details in the relevant security advisories and contact us if you have more questions.

Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.

Bug fixes

  • engine: Improved data: URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addresses GHSA-v6mg-96c6-gmpq.

Other changes

  • Updated the es-toolkit dependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described in GHSA-rh54-vffm-5fvp.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Changelog

Sourced from ckeditor5's changelog.

48.5.1 (September 16, 2026)

CKEditor 5 v48.5.1 is now available.

Release highlights

This release addresses two cross-site scripting (XSS) vulnerabilities in the CKEditor 5 engine.

The first vulnerability (GHSA-rh54-vffm-5fvp) is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the editor processes incoming style attribute values. The underlying issue has been patched by the library maintainers, and the fix has been incorporated into CKEditor 5.

The second vulnerability (GHSA-v6mg-96c6-gmpq) affects only installations where General HTML Support is enabled with a specific configuration that allows inserting objects. This vulnerability could lead to unauthorized JavaScript code execution in a browser context isolated from the origin of the application embedding the editor.

You can read more details in the relevant security advisories and contact us if you have more questions.

Note: Publication of the official CVE records for these issues is pending. Due to a significant increase in CVE publication requests across the industry, GitHub has indicated that the process may take approximately five weeks.

Bug fixes

  • engine: Improved data: URI filtering in the editing view by allowing only binary image, audio and video MIME types. This change addresses GHSA-v6mg-96c6-gmpq.

Other changes

  • Updated the es-toolkit dependency from v1.45.1 to v1.52.0 to address the prototype pollution vulnerability described in GHSA-rh54-vffm-5fvp.

Released packages

Check out the Versioning policy guide for more information.

Other releases:

... (truncated)

Commits
  • 1867f7a Release v48.5.1.
  • 4d9c5bb Changelog for v48.5.1.
  • 352bb6e Release v48.5.0.
  • 6b9d3c5 Changelog for v48.5.0.
  • d5d1ffc Added TableProperties to the table scroll manual test configuration.
  • ab74a53 Converted package translation files from .po to .ts format across all pac...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [ckeditor5](https://github.com/ckeditor/ckeditor5) from 48.4.0 to 48.5.1.
- [Release notes](https://github.com/ckeditor/ckeditor5/releases)
- [Changelog](https://github.com/ckeditor/ckeditor5/blob/master/CHANGELOG.md)
- [Commits](ckeditor/ckeditor5@v48.4.0...v48.5.1)

---
updated-dependencies:
- dependency-name: ckeditor5
  dependency-version: 48.5.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from nkissebe as a code owner November 2, 2026 17:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1969.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/core/plugins/editors/ckeditor5/build/ckeditor5-48.5.1 branch November 2, 2026 17:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants