Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinymce | tinymce | before 5.10.8; 6.0.0 to before 6.7.1 | 5.10.8, 6.7.1 | Patch available | CNA |
| — | tinymce (npm) | 6.0.0 to before 6.7.1 | 6.7.1 | Patch available | GHSA-v65r-p3vv-jjfv |
| — | TinyMCE (NuGet) | 6.0.0 to before 6.7.1 | 6.7.1 | Patch available | GHSA-v65r-p3vv-jjfv |
| — | tinymce/tinymce (Packagist) | 6.0.0 to before 6.7.1 | 6.7.1 | Patch available | GHSA-v65r-p3vv-jjfv |
| — | tinymce (npm) | before 5.10.8 | 5.10.8 | Patch available | GHSA-v65r-p3vv-jjfv |
| — | TinyMCE (NuGet) | before 5.10.8 | 5.10.8 | Patch available | GHSA-v65r-p3vv-jjfv |
| — | tinymce/tinymce (Packagist) | before 5.10.8 | 5.10.8 | Patch available | GHSA-v65r-p3vv-jjfv |
- tinymce Vendortinymce Affected before 5.10.8; 6.0.0 to before 6.7.1 Fixed in 5.10.8, 6.7.1 Patch available CNA
- tinymce (npm) Vendor— Affected 6.0.0 to before 6.7.1 Fixed in 6.7.1 Patch available GHSA-v65r-p3vv-jjfv
- TinyMCE (NuGet) Vendor— Affected 6.0.0 to before 6.7.1 Fixed in 6.7.1 Patch available GHSA-v65r-p3vv-jjfv
- tinymce/tinymce (Packagist) Vendor— Affected 6.0.0 to before 6.7.1 Fixed in 6.7.1 Patch available GHSA-v65r-p3vv-jjfv
- tinymce (npm) Vendor— Affected before 5.10.8 Fixed in 5.10.8 Patch available GHSA-v65r-p3vv-jjfv
- TinyMCE (NuGet) Vendor— Affected before 5.10.8 Fixed in 5.10.8 Patch available GHSA-v65r-p3vv-jjfv
- tinymce/tinymce (Packagist) Vendor— Affected before 5.10.8 Fixed in 5.10.8 Patch available GHSA-v65r-p3vv-jjfv
Remediation
- Fix · CNA tinymce (tinymce) Fixed in 5.10.8, 6.7.1
- Fix · GHSA-v65r-p3vv-jjfv tinymce (npm) Fixed in 6.7.1 Advisory →
- Fix · GHSA-v65r-p3vv-jjfv TinyMCE (NuGet) Fixed in 6.7.1 Advisory →
- Fix · GHSA-v65r-p3vv-jjfv tinymce/tinymce (Packagist) Fixed in 6.7.1 Advisory →
- Fix · GHSA-v65r-p3vv-jjfv tinymce (npm) Fixed in 5.10.8 Advisory →
- Fix · GHSA-v65r-p3vv-jjfv TinyMCE (NuGet) Fixed in 5.10.8 Advisory →
- Fix · GHSA-v65r-p3vv-jjfv tinymce/tinymce (Packagist) Fixed in 5.10.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45818
- 2026-10-03 Alias added: GHSA-v65r-p3vv-jjfv
- 2026-10-20 EPSS moved to the 50th–90th percentile
References
Advisory 3
Other 5
- https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
- https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes
- https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser/
- https://github.com/tinymce/tinymce
- https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.saxparser
More tinymce vulnerabilities
- TI-2011-04153 Static code injection vulnerability in inc/function.base.php in Ajax File and Image… CVSS 2.0HIGH 7.5
- TI-2026-81439 Cross-site scripting in TinyMCE media plugin via data-mce-object CVSS 4.0HIGH 8.5
- TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
- TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
- TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
- TI-2026-35257 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVSS 3.1HIGH 8.7
Sources
- CVE-2023-45818 · CVE Program
- CVE-2023-45818 · NVD
- FIRST EPSS
- GHSA-v65r-p3vv-jjfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences