Description
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tinymce | tinymce | < 5.11.0, >= 6.0.0, <6.8.4, >= 7.0.0, < 7.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | roundcube | No fix yet | — |
| Ubuntu 25.10 | roundcube | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | roundcube | No fix yet | — |
| Ubuntu Pro 24.04 LTS | roundcube | 1.6.6+dfsg-2ubuntu0.1+esm3 | — |
| Ubuntu Pro 22.04 LTS | roundcube | 1.5.0+dfsg.1-2ubuntu0.1~esm6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tinymce | < 5.11.0 | 5.11.0 | GHSA-9hcv-j9pv-qmph |
| npm | tinymce | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-9hcv-j9pv-qmph |
| npm | tinymce | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-9hcv-j9pv-qmph |
| NuGet | TinyMCE | < 5.11.0 | 5.11.0 | GHSA-9hcv-j9pv-qmph |
| NuGet | TinyMCE | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-9hcv-j9pv-qmph |
| NuGet | TinyMCE | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-9hcv-j9pv-qmph |
| Packagist | tinymce/tinymce | < 5.11.0 | 5.11.0 | GHSA-9hcv-j9pv-qmph |
| Packagist | tinymce/tinymce | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-9hcv-j9pv-qmph |
| Packagist | tinymce/tinymce | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-9hcv-j9pv-qmph |
| PyPI | django-tinymce | < 4.1.0 | 4.1.0 | PYSEC-2026-1301 |
Advisories 5
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2025-1555 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0386 Kwetsbaarheden verholpen in Zimbra NCSC-NL (Netherlands) · Oct 10, 2024
- WID-SEC-2024-2071 IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Sep 5, 2024
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph
- https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
- https://owasp.org/www-community/attacks/xss
- https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview
- https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview