TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

中 5.4CVE-2026-47760 · GHSA-mh5m-5hw4-5c69 · 28/05/2026 公開 · 14/10/2026 更新

要点

CVE-2026-47760 は TinyMCE, tinymce/tinymce, tinymce (tiny) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.19%（全脆弱性の 8.8% より高い）。
対処：7.1.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
TinyMCE NuGet	`≥ 6.8.0, < 7.1.0`	`7.1.0`
tinymce/tinymce Packagist	`≥ 6.8.0, < 7.1.0`	`7.1.0`
tinymce tiny	`≥ 6.8.0, < 7.1.0`	`7.1.0`
tinymce npm	`≥ 6.8.0, < 7.1.0`	`7.1.0`

概要

Impact

TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript.

Patches

This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.

Workarounds

No official workaround available.

Acknowledgements

Tiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability.

References

Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.

NVD の説明

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.