tinymce vulnerabilities
Web based JavaScript HTML WYSIWYG editor control.
- Registry
- npm
- Latest
- 8.10.0
- License
- SEE LICENSE IN license.md
20 known advisories
The latest version, 8.10.0, is not affected by any of them. Projects on older versions may be.
npm install tinymce@8.10.0Security advisories for tinymce
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
- Affected
- <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
- Fixed in
- 7.9.3, 8.5.1
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
- Affected
- <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
- Fixed in
- 7.9.3, 8.5.1
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
- Affected
- <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
- Fixed in
- 7.9.3, 8.5.1
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
- Affected
- >=6.8.0 <7.1.0
- Fixed in
- 7.1.0
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
- Affected
- <5.11.0 · >=6.0.0 <6.8.4 · >=7.0.0 <7.2.0
- Fixed in
- 5.11.0, 6.8.4, 7.2.0
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
- Affected
- <5.11.0 · >=6.0.0 <6.8.4 · >=7.0.0 <7.2.0
- Fixed in
- 5.11.0, 6.8.4, 7.2.0
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
- Affected
- <6.8.1
- Fixed in
- 6.8.1
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
- Affected
- <7.0.0
- Fixed in
- 7.0.0
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
- Affected
- <5.10.9 · >=6.0.0 <6.7.3
- Fixed in
- 5.10.9, 6.7.3
TinyMCE XSS vulnerability in notificationManager.open API
- Affected
- >=6.0.0 <6.7.1 · <5.10.8
- Fixed in
- 5.10.8, 6.7.1
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
- Affected
- >=6.0.0 <6.7.1 · <5.10.8
- Fixed in
- 5.10.8, 6.7.1
Cross-site scripting vulnerability in TinyMCE alerts
- Affected
- >=6.0.0 <6.3.1 · <5.10.7
- Fixed in
- 5.10.7, 6.3.1
Cross-site scripting vulnerability in TinyMCE plugins
- Affected
- <5.10.0
- Fixed in
- 5.10.0
Cross-site scripting vulnerability in TinyMCE
- Affected
- <5.9.0
- Fixed in
- 5.9.0
Cross-site scripting vulnerability in TinyMCE
- Affected
- <5.7.1
- Fixed in
- 5.7.1
Cross-site scripting vulnerability in TinyMCE
- Affected
- <5.6.0
- Fixed in
- 5.6.0
Regex denial of service vulnerability in codesample plugin
- Affected
- <5.6.0
- Fixed in
- 5.6.0
Cross-site scripting vulnerability in TinyMCE
- Affected
- <4.9.11 · >=5.0.0 <5.4.1
- Fixed in
- 4.9.11, 5.4.1
XSS in TinyMCE
- Affected
- <4.9.10 · >=5.0.0 <5.2.2
- Fixed in
- 4.9.10, 5.2.2
Cross-site scripting vulnerability in TinyMCE
- Affected
- <4.9.7 · >=5.0.0 <5.1.4
- Fixed in
- 4.9.7, 5.1.4
Which of your client projects still run an old tinymce?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.