EUVD-2026-41424

fkie_cve-2020-12648

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

GHSA-vrv8-v4w8-f95h — Cross-site scripting vulnerability in TinyMCE

Affected: npm: tinymce

### Impact A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

### Patches This vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.

### Workarounds The workarounds available are: - upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1 or - enable the media plugin, which overrides the default parsing behaviour for iframes or - add the following workaround to update the parsing schema rules for iframes:

#### Example: Change the default schema for iframes ```js setup: function(editor) { editor.on('PreInit', function() { editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi; }); } ```

### Acknowledgements Tiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.

### References https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes

### For more information If you have any questions or comments about this advisory: * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues) * Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

UBUNTU-CVE-2020-12648

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

Most recent entries from all

EUVD-2026-41424

fkie_cve-2020-12648

GHSA-vrv8-v4w8-f95h — Cross-site scripting vulnerability in TinyMCE

gsd-2020-12648

UBUNTU-CVE-2020-12648