Special characters in unescaped text nodes can trigger mXSS in TinyMCE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinymce | tinymce | >= 6.0.0 < 6.7.3; before 5.10.9 | 5.10.9 | Patch available | CNA |
| — | tinymce (npm) | before 5.10.9 | 5.10.9 | Patch available | GHSA-v626-r774-j7f8 |
| — | tinymce (npm) | 6.0.0 to before 6.7.3 | 6.7.3 | Patch available | GHSA-v626-r774-j7f8 |
| — | tinymce/tinymce (Packagist) | before 5.10.9 | 5.10.9 | Patch available | GHSA-v626-r774-j7f8 |
| — | tinymce/tinymce (Packagist) | 6.0.0 to before 6.7.3 | 6.7.3 | Patch available | GHSA-v626-r774-j7f8 |
| — | TinyMCE (NuGet) | before 5.10.9 | 5.10.9 | Patch available | GHSA-v626-r774-j7f8 |
| — | TinyMCE (NuGet) | 6.0.0 to before 6.7.3 | 6.7.3 | Patch available | GHSA-v626-r774-j7f8 |
- tinymce Vendortinymce Affected >= 6.0.0 < 6.7.3; before 5.10.9 Fixed in 5.10.9 Patch available CNA
- tinymce (npm) Vendor— Affected before 5.10.9 Fixed in 5.10.9 Patch available GHSA-v626-r774-j7f8
- tinymce (npm) Vendor— Affected 6.0.0 to before 6.7.3 Fixed in 6.7.3 Patch available GHSA-v626-r774-j7f8
- tinymce/tinymce (Packagist) Vendor— Affected before 5.10.9 Fixed in 5.10.9 Patch available GHSA-v626-r774-j7f8
- tinymce/tinymce (Packagist) Vendor— Affected 6.0.0 to before 6.7.3 Fixed in 6.7.3 Patch available GHSA-v626-r774-j7f8
- TinyMCE (NuGet) Vendor— Affected before 5.10.9 Fixed in 5.10.9 Patch available GHSA-v626-r774-j7f8
- TinyMCE (NuGet) Vendor— Affected 6.0.0 to before 6.7.3 Fixed in 6.7.3 Patch available GHSA-v626-r774-j7f8
Remediation
- Fix · CNA tinymce (tinymce) Fixed in 5.10.9
- Fix · GHSA-v626-r774-j7f8 tinymce (npm) Fixed in 5.10.9 Advisory →
- Fix · GHSA-v626-r774-j7f8 tinymce (npm) Fixed in 6.7.3 Advisory →
- Fix · GHSA-v626-r774-j7f8 tinymce/tinymce (Packagist) Fixed in 5.10.9 Advisory →
- Fix · GHSA-v626-r774-j7f8 tinymce/tinymce (Packagist) Fixed in 6.7.3 Advisory →
- Fix · GHSA-v626-r774-j7f8 TinyMCE (NuGet) Fixed in 5.10.9 Advisory →
- Fix · GHSA-v626-r774-j7f8 TinyMCE (NuGet) Fixed in 6.7.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-48219
- 2026-10-03 Alias added: GHSA-v626-r774-j7f8
References
Advisory 2
Other 7
- https://tiny.cloud/docs/release-notes/release-notes5109/
- https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes/
- https://github.com/tinymce/tinymce
- https://github.com/tinymce/tinymce/releases/tag/5.10.9
- https://github.com/tinymce/tinymce/releases/tag/6.7.3
- https://tiny.cloud/docs/release-notes/release-notes5109
- https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes
More tinymce vulnerabilities
- TI-2011-04153 Static code injection vulnerability in inc/function.base.php in Ajax File and Image… CVSS 2.0HIGH 7.5
- TI-2026-81439 Cross-site scripting in TinyMCE media plugin via data-mce-object CVSS 4.0HIGH 8.5
- TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
- TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
- TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
- TI-2026-35257 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVSS 3.1HIGH 8.7
Sources
- CVE-2023-48219 · CVE Program
- CVE-2023-48219 · NVD
- FIRST EPSS
- GHSA-v626-r774-j7f8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences