npm / PACKAGE INTELLIGENCE

@ckeditor/ckeditor5-engine

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

The editing engine of CKEditor 5 – the best browser-based rich text editor.

Latest release49.0.1

Declared licenseSEE LICENSE IN LICENSE.md

Listed maintainersckeditor

Runtime dependencies2

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationNot marked deprecated

Direct dependencies of 49.0.1

es-toolkit1.52.0
@ckeditor/ckeditor5-utils49.0.1

Fetched 28/10/2026, 09:08:37 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high8.1

CVE-2026-116688Fix available

CKEditor: Cross-site scripting (XSS) in the engine package

27 Oct 2026

@ckeditor/ckeditor5-engine npm

Affected range	Recorded fix
From 45.0.0 before 47.7.4Semantic versions	47.7.4

Version evidence: OSV · GHSA-rh54-vffm-5fvp

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "45.0.0"
        },
        {
          "fixed": "47.7.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

@ckeditor/ckeditor5-engine npm

Affected range	Recorded fix
From 48.0.0 before 48.5.1Semantic versions	48.5.1

Version evidence: OSV · GHSA-rh54-vffm-5fvp

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "48.0.0"
        },
        {
          "fixed": "48.5.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

low3.1

CVE-2026-116687Fix available

CKEditor: Cross-site scripting (XSS) in the engine package

npm / ckeditor5 npm / @ckeditor/ckeditor5-engine

27 Oct 2026

@ckeditor/ckeditor5-engine npm

Affected range	Recorded fix
From 29.0.0 before 47.7.4Semantic versions	47.7.4

Version evidence: OSV · GHSA-v6mg-96c6-gmpq

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "29.0.0"
        },
        {
          "fixed": "47.7.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

@ckeditor/ckeditor5-engine npm

Affected range	Recorded fix
From 48.0.0 before 48.5.1Semantic versions	48.5.1

Version evidence: OSV · GHSA-v6mg-96c6-gmpq

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "48.0.0"
        },
        {
          "fixed": "48.5.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}