GHSA-mh5m-5hw4-5c69
High · 8.7CVSS
8.7
EPSS
—
Published
Jun 5, 2026
CISA due date
—
The record
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | TinyMCE | 6.8.0 | 7.1.0 |
| Packagist | tinymce/tinymce | 6.8.0 | 7.1.0 |
| npm | tinymce | 6.8.0 | 7.1.0 |
Related vulnerabilities
- CVE-2026-47760 TinyMCE is an open source rich text editor. Same vulnerability
- GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object`… Also affects TinyMCE
- GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments Also affects TinyMCE
- GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src… Also affects TinyMCE
- CVE-2026-47759 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2026-47762 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2026-47761 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2024-38356 TinyMCE is an open source rich text editor. Also affects TinyMCE