https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:30:30 +0000 https://cve.radiocsirt.org/vuln/ghsa-v98h-vmpc-fpqv <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.</p> <p>### Patches Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.</p> <p>### Workarounds No official workaround available.</p> <p>### Fix To avoid this vulnerability:</p> <p>Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).</p> <p>### Acknowledgements Tiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.</p> <p><strong>Affected:</strong> npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce</p> <p>### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.</p> <p>### Patches Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.</p> <p>### Workarounds No official workaround available.</p> <p>### Fix To avoid this vulnerability:</p> <p>Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).</p> <p>### Acknowledgements Tiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-v98h-vmpc-fpqv