TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

CAO 8.5CVE-2026-116675 · GHSA-mf2p-h6hf-fcwm · Công bố 27/10/2026 · cập nhật 28/10/2026

Tóm tắt nhanh

CVE-2026-116675 là lỗ hổng mức CAO (CVSS 8.5) ảnh hưởng TinyMCE, tinymce/tinymce, tinymce.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.35%, cao hơn 28.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.9.4, 8.9.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
TinyMCE NuGet	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`
tinymce/tinymce Packagist	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`
tinymce npm	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`

Mô tả

Impact

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.

Patches

This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.

Workarounds

No official workaround available.

Fix

To avoid this vulnerability:

Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher.

Acknowledgements

Tiny thanks Fariskhi Vidyan and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

Mô tả của NVD

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.