TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. This vulnerability is fixed in 6.8.1 and 7.0.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00713 53rd percentileScored 2026-11-07
Fix Fixed tinymce (tinymce): 7.0.0tinymce/tinymce (Packagist): 7.0.0+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tinymce | tinymce | before 7.0.0 | 7.0.0 | Patch available | CNA |
| — | tinymce/tinymce (Packagist) | before 7.0.0 | 7.0.0 | Patch available | GHSA-5359-pvf2-pw78 |
| — | tinymce (npm) | before 7.0.0 | 7.0.0 | Patch available | GHSA-5359-pvf2-pw78 |
| — | TinyMCE (NuGet) | before 7.0.0 | 7.0.0 | Patch available | GHSA-5359-pvf2-pw78 |
- tinymce Vendortinymce Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
- tinymce/tinymce (Packagist) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-5359-pvf2-pw78
- tinymce (npm) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-5359-pvf2-pw78
- TinyMCE (NuGet) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-5359-pvf2-pw78
Remediation
- Fix · CNA tinymce (tinymce) Fixed in 7.0.0
- Fix · GHSA-5359-pvf2-pw78 tinymce/tinymce (Packagist) Fixed in 7.0.0 Advisory →
- Fix · GHSA-5359-pvf2-pw78 tinymce (npm) Fixed in 7.0.0 Advisory →
- Fix · GHSA-5359-pvf2-pw78 TinyMCE (NuGet) Fixed in 7.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29881
- 2026-10-03 Alias added: GHSA-5359-pvf2-pw78
References
Advisory 2
Other 3
- https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
- https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#convert_unsafe_embeds-editor-option-is-now-defaulted-to-true
- https://github.com/tinymce/tinymce
More tinymce vulnerabilities
- TI-2011-04153 Static code injection vulnerability in inc/function.base.php in Ajax File and Image… CVSS 2.0HIGH 7.5
- TI-2026-81439 Cross-site scripting in TinyMCE media plugin via data-mce-object CVSS 4.0HIGH 8.5
- TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
- TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
- TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
- TI-2026-35257 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVSS 3.1HIGH 8.7
Sources
- CVE-2024-29881 · CVE Program
- CVE-2024-29881 · NVD
- FIRST EPSS
- GHSA-5359-pvf2-pw78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences