{"id":"GHSA-mh5m-5hw4-5c69","summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs","details":"### Impact\nTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested \u003csvg\u003e elements can bypass attribute sanitization and execute arbitrary JavaScript.\n\n### Patches\nThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.\n\n### Workarounds\nNo official workaround available.\n\n### Acknowledgements\nTiny thanks [maple3142](https://github.com/maple3142) (\u003chttps://maple3142.net\u003e) of DEVCORE for their help identifying this vulnerability.\n\n### References\nFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.","aliases":["CVE-2026-47760"],"modified":"2026-08-24T00:36:58.150126005Z","published":"2026-06-05T20:09:38Z","database_specific":{"github_reviewed_at":"2026-06-05T20:09:38Z","nvd_published_at":"2026-05-28T16:16:28Z","cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47760"},{"type":"PACKAGE","url":"https://github.com/tinymce/tinymce"}],"affected":[{"package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"}},{"package":{"name":"TinyMCE","ecosystem":"NuGet","purl":"pkg:nuget/TinyMCE"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}]}],"versions":["6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"}},{"package":{"name":"tinymce/tinymce","ecosystem":"Packagist","purl":"pkg:composer/tinymce/tinymce"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}]}],"versions":["6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}