CVE-2019-1010091: XSS in TinyMCE
Summary
CVE-2019-1010091: XSS in TinyMCE. Affects tinymce across 2 version ranges.
< 4.9.10
>= 5.0.0, < 5.2.2
Fixed in 4.9.10 or 5.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for embedding rich text editing capabilities into web applications. It allows users to easily create and edit content with a familiar word processor-like interface. However, versions 4.9.9 and lower of TinyMCE, as well as versions 5.2.1 and lower, are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows an attacker to execute arbitrary JavaScript code by inserting specially crafted content into the editor via the clipboard or APIs.
Vulnerability Detail
The XSS vulnerability in TinyMCE arises from a flaw in the core parser and the 'media' plugin. By exploiting this vulnerability, an attacker can inject malicious JavaScript code into the editor, which will be executed when the content is rendered. This can lead to various security issues, including session hijacking, data theft, and defacement of the affected web application. The vulnerability affects all users of TinyMCE versions 4.9.9 or lower and 5.2.1 or lower.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.9.104.9.10npm install tinymce@4.9.10 -
>= 5.0.0, < 5.2.25.2.2npm install tinymce@5.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, a workaround is available. Users can disable the 'media' plugin and manually sanitize CDATA content. The following code snippet demonstrates how to strip CDATA elements manually:
setup: function(editor) {
editor.on('PreInit', function() {
editor.parser.addNodeFilter('#cdata', function(nodes) {
for (var i = 0; i < nodes.length; i++) {
nodes[i].remove();
}
});
});
}
Conclusion
The XSS vulnerability in TinyMCE can have serious security implications for web applications using affected versions. It is crucial to upgrade to the patched versions or apply the provided workaround to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the affected web application. This can lead to various security risks, including data theft, session hijacking, and website defacement.
TinyMCE versions 4.9.9 and lower, as well as versions 5.2.1 and lower, are affected by this XSS vulnerability.
The recommended mitigation is to upgrade to either TinyMCE version 4.9.10 or version 5.2.2. These versions include fixes for the XSS vulnerability.
Yes, if immediate upgrading is not possible, you can disable the 'media' plugin and manually sanitize CDATA content as described in the provided code snippet.
The vulnerabilities were discovered by Michał Bentkowski and intivesec. They were reported to Tiny Technologies, the maintainers of TinyMCE.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
