GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

• npm tinymce: <= 5.10.9 (no fix yet) • npm tinymce: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • npm tinymce: >= 8.0.0, < 8.5.1 → fixed in 8.5.1 • NuGet TinyMCE: <= 5.10.9 (no fix yet) • NuGet TinyMCE: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • NuGet TinyMCE: >= 8.0.0, < 8.5.1 → fixed in 8.5.1 • Packagist tinymce/tinymce: <= 5.10.9 (no fix yet) • Packagist tinymce/tinymce: >= 6.0.0, < 7.9.3 → fixed in 7.9.3 • Packagist tinymce/tinymce: >= 8.0.0, < 8.5.1 → fixed in 8.5.1

Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. Patches Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. Workarounds No official workaround available. Fix To avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). Acknowledgements Tiny thanks Ivan Babenko for their help identifying this vulnerability.