CVE-2020-17480: Cross-site scripting vulnerability in TinyMCE
Summary
CVE-2020-17480: Cross-site scripting vulnerability in TinyMCE. Affects tinymce across 2 version ranges.
< 4.9.7
>= 5.0.0, < 5.1.4
Fixed in 4.9.7 or 5.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for embedding rich text editing capabilities into web applications. It provides a user-friendly interface for creating and editing content with features like formatting, tables, images, and more. However, versions 4.9.6 and lower of TinyMCE, as well as versions 5.1.3 and lower, are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows an attacker to execute arbitrary JavaScript code by inserting specially crafted content into the editor via the clipboard or APIs.
Vulnerability Detail
The XSS vulnerability in TinyMCE arises from flaws in the core parser, as well as the 'paste' and 'visualchars' plugins. When a user inserts malicious content into the editor, either through copying and pasting or programmatically, the vulnerable versions of TinyMCE fail to properly sanitize the input. As a result, the injected JavaScript code gets executed within the context of the user's browser, potentially leading to session hijacking, defacement, or other malicious activities. The impact of this vulnerability affects all users of TinyMCE versions 4.9.6 and lower, as well as versions 5.1.3 and lower.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.9.74.9.7npm install tinymce@4.9.7 -
>= 5.0.0, < 5.1.45.1.4npm install tinymce@5.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately feasible, there are a few workarounds available. One option is to disable the impacted plugins, namely 'paste' and 'visualchars'. Another workaround involves manually sanitizing the content using the 'BeforeSetContent' event. Here is an example of how to implement this workaround:
editor.on('BeforeSetContent', function(e) {
var sanitizedContent = ...; // Manually sanitize content here
e.content = sanitizedContent;
});
Conclusion
The XSS vulnerability in TinyMCE can have serious security implications for web applications using the affected versions. It is crucial to upgrade to the patched versions (4.9.7 or 5.1.4) or apply the recommended workarounds to prevent potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to various malicious activities such as session hijacking, defacement, or data theft.
TinyMCE versions 4.9.6 and lower, as well as versions 5.1.3 and lower, are affected by this vulnerability.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is important to apply the recommended patches or workarounds to mitigate the risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
The vulnerability was discovered by Michał Bentkowski and reported to Tiny Technologies.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
