CVE-2022-23494: Cross-site scripting vulnerability in TinyMCE alerts
Summary
CVE-2022-23494: Cross-site scripting vulnerability in TinyMCE alerts. Affects tinymce across 2 version ranges.
< 5.10.7
>= 6.0.0, < 6.3.1
Fixed in 5.10.7 or 6.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for creating rich text content in web applications. It provides a user-friendly interface for editing and formatting text, including features like image uploading. However, a vulnerability has been discovered in TinyMCE that allows for cross-site scripting (XSS) attacks. This vulnerability specifically affects the alert and confirm dialogs in plugins that use them, such as the image plugin. When these dialogs are provided with malicious HTML content, arbitrary JavaScript can be executed in the context of the current user's session, potentially leading to unauthorized actions or data theft.
Vulnerability Detail
The XSS vulnerability in TinyMCE's alert and confirm dialogs arises from a lack of proper HTML sanitization. When these dialogs are presented with malicious HTML content, the injected JavaScript code can execute within the TinyMCE UI, posing a risk to the user's session. This vulnerability has a CVSS score of 5.4, indicating a moderate severity level. Exploiting this vulnerability could lead to unauthorized access, data manipulation, or phishing attacks.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.10.75.10.7npm install tinymce@5.10.7 -
>= 6.0.0, < 6.3.16.3.1npm install tinymce@6.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can ensure that the images_upload_handler returns a valid value as per the images_upload_handler documentation. This can help reduce the impact of the vulnerability until the software is updated to the patched versions.
Conclusion
The cross-site scripting vulnerability in TinyMCE's alert and confirm dialogs can be mitigated by upgrading to the latest patched versions. It is important to promptly apply these updates to ensure the security of your web application. If you have any further questions or need assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
TinyMCE is an open-source WYSIWYG editor used for creating rich text content in web applications. It provides a user-friendly interface for editing and formatting text, including features like image uploading.
The vulnerability allows for cross-site scripting (XSS) attacks in TinyMCE's alert and confirm dialogs. Exploiting this vulnerability could lead to unauthorized access, data manipulation, or phishing attacks.
To fix this vulnerability, upgrade to the latest patched versions of TinyMCE (5.10.7 or higher for TinyMCE 5.x, and 6.3.1 or higher for TinyMCE 6.x). These versions include proper HTML sanitization to prevent the execution of arbitrary JavaScript code.
Yes, as a temporary workaround, developers can ensure that the images_upload_handler returns a valid value as per the images_upload_handler documentation. This can help reduce the impact of the vulnerability until the software is updated.
For more information, you can refer to the TinyMCE release notes for the patched versions (5.10.7 and 6.3.1) and the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
