GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
At a glance
- Published
- Updated
- CVE
- CVE-2026-47760
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Description
### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript. ### Patches This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. ### Workarounds No official workaround available. ### Acknowledgements Tiny thanks [maple3142](https://github.com/maple3142) (<https://maple3142.net>) of DEVCORE for their help identifying this vulnerability. ### References Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.
Affected packages
| Package | Versions |
|---|---|
| npm · tinymce | introduced 6.8.0, fixed 7.1.0 |
| NuGet · TinyMCE | introduced 6.8.0, fixed 7.1.0 |
| Packagist · tinymce/tinymce | introduced 6.8.0, fixed 7.1.0 |
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-47760 ADVISORY
- https://github.com/tinymce/tinymce PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |