Cross-site scripting vulnerability in TinyMCE
Summary
GHSA-5vm8-hhgr-jcjp: Cross-site scripting vulnerability in TinyMCE. Affects tinymce versions < 5.7.1. Fixed in 5.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor that allows users to easily create and edit content on websites. It provides a rich set of features for formatting text, inserting media, and managing content. However, a cross-site scripting (XSS) vulnerability has been discovered in TinyMCE version 5.7.0 and lower. This vulnerability allows an attacker to execute arbitrary JavaScript code when a specially crafted piece of content is inserted into the editor and then previewed or rendered outside of the editor.
Vulnerability Detail
The XSS vulnerability in TinyMCE is due to a flaw in the URL sanitization logic of the core parser for form elements. When a form element with a malicious URL attribute is inserted into the editor, the URL is not properly sanitized, allowing the execution of arbitrary JavaScript code. This can lead to various security risks, such as stealing user credentials, performing actions on behalf of the user, or defacing the website. The vulnerability has been patched in TinyMCE version 5.7.1 by improving the URL sanitization logic.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.1
This is the first release that contains the fix.
npm install tinymce@5.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading or manual sanitization is not possible, another workaround is to disable form elements in the content using the 'invalid_elements' setting in TinyMCE configuration. By specifying 'form' as an invalid element, any form elements present in the content will be removed or ignored. This can help mitigate the risk of the XSS vulnerability, but it may also affect the functionality of the editor if form elements are required.
Conclusion
The cross-site scripting vulnerability in TinyMCE version 5.7.0 and lower can be mitigated by upgrading to version 5.7.1 or higher. Alternatively, manual sanitization of form URL attributes using a node filter or disabling form elements in the content can also help mitigate the risk. It is important to take action to protect your website and users from potential attacks. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code when a specially crafted piece of content is inserted into TinyMCE and then previewed or rendered outside of the editor. This can lead to various security risks, such as stealing user credentials or performing actions on behalf of the user.
The vulnerability affects TinyMCE version 5.7.0 and lower. Users of these versions are advised to upgrade to version 5.7.1 or higher to mitigate the vulnerability.
To manually sanitize form URL attributes, you can use a TinyMCE node filter. This involves iterating through the form elements, sanitizing the URL attribute values, and updating the attributes accordingly. An example code snippet for sanitizing using a node filter is provided in the vulnerability details.
Yes, you can disable form elements in TinyMCE by using the 'invalid_elements' setting in the TinyMCE configuration. By specifying 'form' as an invalid element, any form elements present in the content will be removed or ignored.
The vulnerability was discovered by Mikhail Khramenkov at Solar Security Research Team. They reported the vulnerability to Tiny Technologies, who promptly patched the issue in TinyMCE version 5.7.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
