~ / search / GHSA-mh5m-5hw4-5c69

GHSA-mh5m-5hw4-5c69

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Source: GitHub Advisory Database (reviewed) High CVE-2026-47760

Packages

EcosystemPackageAffectedFixed in
npm tinymce >= 6.8.0, < 7.1.0 7.1.0
NuGet TinyMCE >= 6.8.0, < 7.1.0 7.1.0
Packagist tinymce/tinymce >= 6.8.0, < 7.1.0 7.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript. ### Patches This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. ### Workarounds No official workaround available. ### Acknowledgements Tiny thanks [maple3142](https://github.com/maple3142) (<https://maple3142.net>) of DEVCORE for their help identifying this vulnerability. ### References Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.

References

External links from the advisory. They lead to third-party sites.