GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

• npm tinymce: <= 5.10.9 (no fix yet) • npm tinymce: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • npm tinymce: >= 8.0.0, < 8.5.1 → fixed in 8.5.1 • NuGet TinyMCE: <= 5.10.9 (no fix yet) • NuGet TinyMCE: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • NuGet TinyMCE: >= 8.0.0, < 8.5.1 → fixed in 8.5.1 • Packagist tinymce/tinymce: <= 5.10.9 (no fix yet) • Packagist tinymce/tinymce: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • Packagist tinymce/tinymce: >= 8.0.0, < 8.5.1 → fixed in 8.5.1

Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. Patches Patched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). Workarounds No official workaround available. Fix To avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). Acknowledgements Tiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability.