UBUNTU-CVE-2026-116675: High severity ubuntu/tinymce vulnerability
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 8.9.3 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 7.9.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using TinyMCE with the media plugin enabled are affected if they run versions 7.9.3 through 7.9.4 or 8.5.1 through 8.9.3. The impact is stored cross-site scripting against users who view maliciously crafted content.
What does an attacker need to exploit it?
The attacker needs privileges sufficient to store crafted content processed by the TinyMCE media plugin. User interaction is required for the stored malicious content to execute in a victim's browser.
Is the default TinyMCE configuration affected?
The issue applies when the media plugin is enabled. The provided information does not establish whether that plugin is enabled by default in a particular Ubuntu deployment or application.
What can be done if upgrading is not immediately possible?
Disable the TinyMCE media plugin where feasible, since the vulnerability is associated with that plugin. Upgrade to 7.9.4 or 8.9.3 when possible.
How can I determine whether my deployment is affected?
Check the deployed TinyMCE version and whether the media plugin is enabled. Versions in the stated affected ranges with the media plugin enabled should be treated as vulnerable.