Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-47760

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

tinymce tinymce

  • >= 6.0.0, < 7.1.0affected

References