Media

Cross-site scripting vulnerability in TinyMCE

Publicada: 06.01.2021
Actualizado: 11.10.2026 11:23

Impact

A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.

Patches

This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.

Workarounds

To work around this vulnerability, either:

Upgrade to TinyMCE 5.6.0 or higher
Manually sanitize iframe, object and embed URL attributes using a TinyMCE node filter.
Disable iframe, object, and embed elements in your content using the invalid_elements setting.

Example: Sanitizing using a node filter

editor.parser.addNodeFilter('iframe,object,embed', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});

Example: Using invalid_elements

invalid_elements: 'iframe,object,embed'

Acknowledgements

Tiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.

References

https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

For more information

If you have any questions or comments about this advisory:

Open an issue in the TinyMCE repo
Email us at infosec@tiny.cloud

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	tinymce/tinymce	< 5.6.0	5.6.0
Paquete de npm	tinymce	< 5.6.0	5.6.0
.NET (NuGet)	TinyMCE	< 5.6.0	5.6.0

Referencias

Puntuación CVSS -

Debilidad (CWE): CWE-79
Plataforma: Composer, npm, .NET (NuGet)
Paquete: tinymce/tinymce, tinymce, TinyMCE
Publicada: 06.01.2021
Actualizado: 11.10.2026 11:23

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-w7jx-j77m-wp65 - CC BY 4.0

Historial de vulnerabilidades: tinymce

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (20) en el archivo

Entradas en total: 20
Primera → última: 01.2020 06.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 5
Media 14
Baja 1

Divulgaciones por año

2020: 3
2021: 5
2022: 1
2023: 3
2024: 4
2025: 0
2026: 4

05.06.2026

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Alta · 8.7 CVE-2026-47761 <= 5.10.9, >= 6.0.0, < 7.9.3, >= 8.0.0, < 8.5.1 7.9.3, 8.5.1
05.06.2026

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

Alta · 8.7 CVE-2026-47762 <= 5.10.9, >= 6.0.0, < 7.9.3, >= 8.0.0, < 8.5.1 7.9.3, 8.5.1
05.06.2026

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Alta · 8.7 CVE-2026-47759 <= 5.10.9, >= 6.0.0, < 7.9.3, >= 8.0.0, < 8.5.1 7.9.3, 8.5.1
05.06.2026

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Alta · 8.7 CVE-2026-47760 >= 6.8.0, < 7.1.0 7.1.0
06.01.2021

Cross-site scripting vulnerability in TinyMCE esta entrada

Media CVE-2024-21911 < 5.6.0 5.6.0
30.01.2020

Cross-site scripting vulnerability in TinyMCE

Alta CVE-2020-17480 < 4.9.7, >= 5.0.0, < 5.1.4 4.9.7, 5.1.4

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación