Regex Denial of Service Vulnerability in TinyMCE codesample Plugin

tinymce Updated 02 Oct 2025

Summary

06/01/2021

Disclosed on

LOW

Severity

Yes i

Fix available

Low

Severity

Not published

CVSS Score

GHSA-h96f-fc7c-9r55: Regex denial of service vulnerability in codesample plugin. Affects tinymce versions < 5.6.0. Fixed in 5.6.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

TinyMCE is a popular open-source WYSIWYG editor used for embedding rich text editing capabilities into web applications. It provides a range of plugins to enhance functionality, including the codesample plugin, which allows users to insert code snippets into their content. However, a vulnerability has been discovered in the codesample plugin that can lead to a regex denial of service (ReDoS) attack. This vulnerability affects TinyMCE versions 5.5.1 and lower.

Vulnerability Detail

The vulnerability arises from a dependency used by the codesample plugin. When poorly formed ruby code samples are encountered, the browser can become unresponsive due to excessive processing required for syntax highlighting. This can be exploited by an attacker to cause a denial of service (DoS) condition on the user's browser. The impact is limited to users of TinyMCE with the codesample plugin enabled and using versions 5.5.1 or lower.

How To Fix

Latest published version: 8.10.0 as of 23 Oct 2026

npm install tinymce@8.10.0

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

5.6.0

This is the first release that contains the fix.

npm install tinymce@5.6.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If upgrading to a newer version of TinyMCE is not feasible at the moment, there are a few workarounds available:

Disable the codesample plugin: This can be done by removing or commenting out the plugin configuration in the TinyMCE initialization code.
Disable ruby code samples: If the codesample plugin is essential, but ruby code samples are not commonly used, you can disable ruby code samples specifically. This can be achieved by configuring the codesample_languages setting to exclude the 'ruby' language.
Override the PrismJS syntax highlighter: If you are using a custom version of the PrismJS syntax highlighter, you can ensure it is updated to version 1.21.0 or higher. This can be done by configuring the codesample_global_prismjs setting to point to the desired version of PrismJS.

Conclusion

In conclusion, a regex denial of service vulnerability has been discovered in the codesample plugin of TinyMCE versions 5.5.1 and lower. This vulnerability can lead to a denial of service condition in the user's browser when encountering poorly formed ruby code samples. To mitigate this vulnerability, it is recommended to upgrade to TinyMCE version 5.6.0 or higher. Alternatively, the provided workarounds can be implemented. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tinymce →

FAQ

What is TinyMCE?

TinyMCE is an open-source WYSIWYG editor used for embedding rich text editing capabilities into web applications. It provides a range of features and plugins to enhance content creation and editing experiences.

What is the `codesample` plugin?

The codesample plugin is a plugin for TinyMCE that allows users to insert code snippets into their content. It provides syntax highlighting for various programming languages.

How does the vulnerability impact users?

The vulnerability impacts users of TinyMCE who have the codesample plugin enabled and are using versions 5.5.1 or lower. It can lead to a denial of service (DoS) condition in the user's browser when encountering poorly formed ruby code samples.

How can I fix the vulnerability?

To fix the vulnerability, it is recommended to upgrade to TinyMCE version 5.6.0 or higher. This version includes a patched version of the dependency with the vulnerability. Alternatively, you can follow the provided workarounds if upgrading is not immediately feasible.

Are there any workarounds available?

Yes, there are a few workarounds available:

Disable the codesample plugin.
Disable ruby code samples using the codesample_languages setting.
Override the PrismJS syntax highlighter to a version without the vulnerability using the codesample_global_prismjs setting.