Description
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tinymce | tinymce | < 5.11.0, >= 6.0.0, <6.8.4, >= 7.0.0, < 7.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | roundcube | No fix yet | — |
| Ubuntu 25.10 | roundcube | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | roundcube | No fix yet | — |
| Ubuntu Pro 24.04 LTS | roundcube | 1.6.6+dfsg-2ubuntu0.1+esm3 | — |
| Ubuntu Pro 22.04 LTS | roundcube | 1.5.0+dfsg.1-2ubuntu0.1~esm6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tinymce | < 5.11.0 | 5.11.0 | GHSA-w9jx-4g6g-rp7x |
| npm | tinymce | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-w9jx-4g6g-rp7x |
| npm | tinymce | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-w9jx-4g6g-rp7x |
| NuGet | TinyMCE | < 5.11.0 | 5.11.0 | GHSA-w9jx-4g6g-rp7x |
| NuGet | TinyMCE | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-w9jx-4g6g-rp7x |
| NuGet | TinyMCE | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-w9jx-4g6g-rp7x |
| Packagist | tinymce/tinymce | < 5.11.0 | 5.11.0 | GHSA-w9jx-4g6g-rp7x |
| Packagist | tinymce/tinymce | >= 6.0.0, < 6.8.4 | 6.8.4 | GHSA-w9jx-4g6g-rp7x |
| Packagist | tinymce/tinymce | >= 7.0.0, < 7.2.0 | 7.2.0 | GHSA-w9jx-4g6g-rp7x |
| PyPI | django-tinymce | < 4.1.0 | 4.1.0 | PYSEC-2026-1302 |
Advisories 3
- WID-SEC-2025-0809 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-2071 IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Sep 5, 2024
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x
- https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d
- https://owasp.org/www-community/attacks/xss
- https://www.tiny.cloud/docs/tinymce/6/6.8.4-release-notes/#overview
- https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview