TinyMCE (NuGet)
Advisories
31
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.9.3 or later clears every advisory below that has a fix.
Upgrade commands
dotnet
dotnet add package TinyMCE --version 8.9.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mf2p-h6hf-fcwm TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
High EPSS 0.35% |
>= 8.5.1, < 8.9.3 | 8.9.3 |
| GHSA-mf2p-h6hf-fcwm TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
High EPSS 0.35% |
>= 7.9.3, < 7.9.4 | 7.9.4 |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
<= 5.10.9 | No fix yet |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
<= 5.10.9 | No fix yet |
| GHSA-mh5m-5hw4-5c69 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs |
Medium EPSS 0.19% |
>= 6.8.0, < 7.1.0 | 7.1.0 |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
<= 5.10.9 | No fix yet |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
>= 6.0.0, < 6.8.4 | 6.8.4 |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
>= 7.0.0, < 7.2.0 | 7.2.0 |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
< 5.11.0 | 5.11.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
>= 7.0.0, < 7.2.0 | 7.2.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
< 5.11.0 | 5.11.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
>= 6.0.0, < 6.8.4 | 6.8.4 |
| GHSA-5359-pvf2-pw78 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements |
Medium EPSS 0.71% |
< 7.0.0 | 7.0.0 |
| GHSA-438c-3975-5x3f TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes |
Medium EPSS 0.71% |
< 6.8.1 | 6.8.1 |
| GHSA-v626-r774-j7f8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes |
Medium EPSS 0.71% |
< 5.10.9 | 5.10.9 |
| GHSA-v626-r774-j7f8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes |
Medium EPSS 0.71% |
>= 6.0.0, < 6.7.3 | 6.7.3 |
| GHSA-hgqx-r2hp-jr38 TinyMCE XSS vulnerability in notificationManager.open API |
Medium EPSS 0.63% |
>= 6.0.0, < 6.7.1 | 6.7.1 |
| GHSA-hgqx-r2hp-jr38 TinyMCE XSS vulnerability in notificationManager.open API |
Medium EPSS 0.63% |
< 5.10.8 | 5.10.8 |
| GHSA-v65r-p3vv-jjfv TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin |
Medium EPSS 0.76% |
< 5.10.8 | 5.10.8 |
| GHSA-v65r-p3vv-jjfv TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin |
Medium EPSS 0.76% |
>= 6.0.0, < 6.7.1 | 6.7.1 |
| GHSA-gg8r-xjwq-4w92 Cross-site scripting vulnerability in TinyMCE alerts |
Medium EPSS 1.01% |
< 5.10.7 | 5.10.7 |
| GHSA-gg8r-xjwq-4w92 Cross-site scripting vulnerability in TinyMCE alerts |
Medium EPSS 1.01% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-r8hm-w5f7-wj39 Cross-site scripting vulnerability in TinyMCE plugins |
Medium EPSS 0.96% |
< 5.10.0 | 5.10.0 |
| GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.07% |
< 5.9.0 | 5.9.0 |
| GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.17% |
< 5.6.0 | 5.6.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor