HighGHSA-mf2p-h6hf-fcwmCVE-2026-116675

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Published 27 Oct 2026 · Updated 27 Oct 2026

Affected packages

tinymcenpm
Affected
>=8.5.1 <8.9.3
Fixed in
8.9.3
Update to the fixed version for your release line, for example:npm install tinymce@8.9.3
tinymce/tinymceComposer
Affected
>=8.5.1 <8.9.3
Fixed in
8.9.3
Update to the fixed version for your release line, for example:composer require tinymce/tinymce:^8.9.3
tinymcenpm
Affected
>=7.9.3 <7.9.4
Fixed in
7.9.4
Update to the fixed version for your release line, for example:npm install tinymce@7.9.4
tinymce/tinymceComposer
Affected
>=7.9.3 <7.9.4
Fixed in
7.9.4
Update to the fixed version for your release line, for example:composer require tinymce/tinymce:^7.9.4

Details

Impact

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.

Patches

This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.

Workarounds

No official workaround available.

Fix

To avoid this vulnerability:

Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher.

Acknowledgements

Tiny thanks Fariskhi Vidyan and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

Is GHSA-mf2p-h6hf-fcwm in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected tinymce, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.