GHSA-mf2p-h6hf-fcwm: XSS

Q: Which deployments are exposed?

TinyMCE deployments with the media plugin enabled are affected. The advisory identifies the TinyMCE packages distributed through Composer, NuGet, and npm.

Q: What does an attacker need to exploit this issue?

An attacker needs a way to inject crafted content containing elements that use the data-mce-object attribute. Those elements can cause malicious scripts to be created and executed before sanitization.

Q: Are there configuration-based mitigations if an upgrade cannot be applied immediately?

No official workaround is available. The documented remediation is to upgrade TinyMCE to 8.9.3 or later, or to 7.9.4 or later.

Published Oct 27, 2026

Updated

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.

Patches This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.

Workarounds No official workaround available.

Fix To avoid this vulnerability:

Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher.

Acknowledgements Tiny thanks Fariskhi Vidyan and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

Affected Software

6 affected componentsFixes available

composer/tinymce/tinymce=7.9.3

7.9.4

nuget/tinymce=7.9.3

7.9.4

npm/tinymce=7.9.3

7.9.4

composer/tinymce/tinymce>=8.5.1<8.9.3

8.9.3

nuget/tinymce>=8.5.1<8.9.3

8.9.3

npm/tinymce>=8.5.1<8.9.3

8.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/tinymce/tinymce to a version that resolves this vulnerability.
Fixed in 7.9.4
Upgrade
Upgrade nuget/TinyMCE to a version that resolves this vulnerability.
Fixed in 7.9.4
Upgrade
Upgrade npm/tinymce to a version that resolves this vulnerability.
Fixed in 7.9.4
Upgrade
Upgrade composer/tinymce/tinymce to a version that resolves this vulnerability.
Fixed in 8.9.3
Upgrade
Upgrade nuget/TinyMCE to a version that resolves this vulnerability.
Fixed in 8.9.3
Upgrade
Upgrade npm/tinymce to a version that resolves this vulnerability.
Fixed in 8.9.3
Upgrade
Upgrade TinyMCE to a version that resolves this vulnerability.
Fixed in 7.9.4
Upgrade
Upgrade TinyMCE to a version that resolves this vulnerability.
Fixed in 8.9.3

Event History

Oct 27, 2026

Advisory Published

via GitHub·09:07 PM

Data Sourced

via GitHub·09:07 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed?

TinyMCE deployments with the media plugin enabled are affected. The advisory identifies the TinyMCE packages distributed through Composer, NuGet, and npm.

What does an attacker need to exploit this issue?

An attacker needs a way to inject crafted content containing elements that use the data-mce-object attribute. Those elements can cause malicious scripts to be created and executed before sanitization.

Are there configuration-based mitigations if an upgrade cannot be applied immediately?

No official workaround is available. The documented remediation is to upgrade TinyMCE to 8.9.3 or later, or to 7.9.4 or later.

GHSA-mf2p-h6hf-fcwm: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are there configuration-based mitigations if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are there configuration-based mitigations if an upgrade cannot be applied immediately?