mXSS Vulnerability in TinyMCE
Summary
CVE-2023-45818: TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin. Affects tinymce across 2 version ranges.
< 5.10.8
>= 6.0.0, < 6.7.1
Fixed in 5.10.8 or 6.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TinyMCE is a popular open-source WYSIWYG editor used for creating rich text content in web applications. It provides a range of features and APIs for content manipulation. However, a vulnerability has been discovered in TinyMCE that allows for mutation cross-site scripting (mXSS) attacks. This vulnerability affects the core undo and redo functionality, as well as the getContent API, resetContent API, and Autosave plugin.
Vulnerability Detail
The mXSS vulnerability in TinyMCE occurs when a carefully-crafted HTML snippet passes the XSS sanitization layer and is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is later restored from the undo stack, the combination of string manipulation and reparative parsing mutates the HTML maliciously, enabling the execution of an XSS payload. This vulnerability can have serious security implications, allowing an attacker to inject and execute arbitrary code within the context of the affected web application.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.10.85.10.8npm install tinymce@5.10.8 -
>= 6.0.0, < 6.7.16.7.1npm install tinymce@6.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of TinyMCE.
Conclusion
The mXSS vulnerability in TinyMCE poses a significant security risk, allowing for the injection and execution of arbitrary code. It is crucial to upgrade to the patched versions of TinyMCE (5.10.8 or higher for TinyMCE 5.x, and 6.7.1 or higher for TinyMCE 6.x) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
This vulnerability allows for mutation cross-site scripting (mXSS) attacks, enabling an attacker to inject and execute arbitrary code within the affected web application.
The vulnerability affects TinyMCE versions 5.0.0 and above, as well as TinyMCE 6.0.0 and above.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1.
For more information, you can refer to the TinyMCE release notes and the GitHub advisory database linked in the references section of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
