GHSA-mf2p-h6hf-fcwm

Dashboard / Vulnerabilities / GHSA-mf2p-h6hf-fcwm

GHSA-mf2p-h6hf-fcwm

Summary: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Details: ### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. ### Patches This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first. ### Workarounds No official workaround available. ### Fix To avoid this vulnerability: Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher. ### Acknowledgements Tiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

References: https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm, https://nvd.nist.gov/vuln/detail/CVE-2026-116675, https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2, https://github.com/tinymce/tinymce, https://github.com/tinymce/tinymce/releases/tag/8.9.3, https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview, https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview