GitHub Advisoryadvisory · npm, NuGet, Packagist

GHSA-mh5m-5hw4-5c69 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

HIGH Published 2026-06-05 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-47760
Ecosystem
npm, NuGet, Packagist
Packages
tinymce, TinyMCE, tinymce/tinymce
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-06-05

Affected packages

• npm tinymce: >= 6.8.0, < 7.1.0 → fixed in 7.1.0 • NuGet TinyMCE: >= 6.8.0, < 7.1.0 → fixed in 7.1.0 • Packagist tinymce/tinymce: >= 6.8.0, < 7.1.0 → fixed in 7.1.0

Description

Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. Patches This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. Workarounds No official workaround available. Acknowledgements Tiny thanks maple3142 () of DEVCORE for their help identifying this vulnerability. References Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-47760 TinyMCE is an open source rich text editor. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References