CVE-2026-47760

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) TinyMCE es un editor de texto enriquecido de código abierto. Desde la 6.8.0 hasta antes de la 7.1.0, TinyMCE contiene una vulnerabilidad XSS causada por un manejo inadecuado del ámbito del espacio de nombres SVG en el saneador. Una carga útil manipulada que utiliza elementos anidados puede eludir la sanitización de atributos y ejecutar JavaScript arbitrario. Esta vulnerabilidad está corregida en la 7.1.0.

Information

Published : 2026-05-28 16:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-47760

Mitre link : CVE-2026-47760

CVE.ORG link : CVE-2026-47760

JSON object : View

Products Affected

tiny

tinymce

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-47760", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47760", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:57:38.689171Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tinymce", "product": "tinymce", "versions": [{"status": "affected", "version": ">= 6.0.0, < 7.1.0"}]}]}], "published": "2026-05-28T16:16:28.210", "references": [{"url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0."}, {"lang": "es", "value": "TinyMCE es un editor de texto enriquecido de c\u00f3digo abierto. Desde la 6.8.0 hasta antes de la 7.1.0, TinyMCE contiene una vulnerabilidad XSS causada por un manejo inadecuado del \u00e1mbito del espacio de nombres SVG en el saneador. Una carga \u00fatil manipulada que utiliza elementos anidados puede eludir la sanitizaci\u00f3n de atributos y ejecutar JavaScript arbitrario. Esta vulnerabilidad est\u00e1 corregida en la 7.1.0."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4034B9F-041D-4ACE-9BC6-9170FE25E725", "versionEndExcluding": "7.1.0", "versionStartIncluding": "6.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}