Cross-site scripting vulnerability in TinyMCE plugins
Summary
GHSA-r8hm-w5f7-wj39: Cross-site scripting vulnerability in TinyMCE plugins. Affects tinymce versions < 5.10.0. Fixed in 5.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.
Patches
This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.
Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.10.0 or higher
- Disable the
imageandlinkplugins
Acknowledgements
Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.
References
https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes
For more information
If you have any questions or comments about this advisory:
- Email us at infosec@tiny.cloud
- Open an issue in the TinyMCE repo
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.10.0
This is the first release that contains the fix.
npm install tinymce@5.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
