Most recent entries from all

EUVD-2026-324014

fkie_cve-2026-47760

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

GHSA-mh5m-5hw4-5c69 — TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Affected: npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce

### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript.

### Patches This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.

### Workarounds No official workaround available.

### Acknowledgements Tiny thanks [maple3142](https://github.com/maple3142) (<https://maple3142.net>) of DEVCORE for their help identifying this vulnerability.

### References Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.

UBUNTU-CVE-2026-47760

Affected: Ubuntu:16.04:LTS: tinymce, Ubuntu:18.04:LTS: tinymce, Ubuntu:20.04:LTS: tinymce