XSS Vulnerability in TinyMCE's Notification Manager API
Summary
CVE-2023-45819: TinyMCE XSS vulnerability in notificationManager.open API. Affects tinymce across 2 version ranges.
< 5.10.8
>= 6.0.0, < 6.7.1
Fixed in 5.10.8 or 6.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for creating rich text content. It provides a user-friendly interface for editing and formatting text within web applications. However, a vulnerability has been discovered in TinyMCE's Notification Manager API, which is responsible for handling error notifications. This vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject malicious code into the editor and execute it within the context of the user's browser. The vulnerability affects versions 5.x and 6.x of TinyMCE.
Vulnerability Detail
The XSS vulnerability in TinyMCE's Notification Manager API arises from the unfiltered display of HTML content within notifications. When a notification is opened, any HTML code within the text argument is rendered without proper sanitization, allowing for arbitrary JavaScript execution. This vulnerability can be exploited by inserting carefully crafted malicious content into the editor and triggering a notification. It poses a moderate risk as it requires specific conditions to be met, but it can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.10.85.10.8npm install tinymce@5.10.8 -
>= 6.0.0, < 6.7.16.7.1npm install tinymce@6.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of TinyMCE as mentioned above.
Conclusion
The XSS vulnerability in TinyMCE's Notification Manager API can be mitigated by upgrading to the latest patched versions. It is important to stay up to date with security updates to protect against potential exploits. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
TinyMCE is an open-source WYSIWYG editor used for creating rich text content in web applications.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities.
Versions 5.x and 6.x of TinyMCE are affected by this vulnerability.
To fix this vulnerability, upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x, and upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.
No specific workarounds are provided. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
