~ / search / GHSA-mf2p-h6hf-fcwm

GHSA-mf2p-h6hf-fcwm

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Source: GitHub Advisory Database (reviewed) High CVE-2026-116675

Packages

EcosystemPackageAffectedFixed in
npm tinymce >= 8.5.1, < 8.9.3 8.9.3
NuGet TinyMCE >= 8.5.1, < 8.9.3 8.9.3
Packagist tinymce/tinymce >= 8.5.1, < 8.9.3 8.9.3
npm tinymce >= 7.9.3, < 7.9.4 7.9.4
NuGet TinyMCE >= 7.9.3, < 7.9.4 7.9.4
Packagist tinymce/tinymce >= 7.9.3, < 7.9.4 7.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. ### Patches This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first. ### Workarounds No official workaround available. ### Fix To avoid this vulnerability: Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher. ### Acknowledgements Tiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

References

External links from the advisory. They lead to third-party sites.