tinymce (npm)
Advisories
44
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.9.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install tinymce@8.9.3yarn
yarn add tinymce@8.9.3pnpm
pnpm add tinymce@8.9.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mf2p-h6hf-fcwm TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
High EPSS 0.35% |
>= 8.5.1, < 8.9.3 | 8.9.3 |
| GHSA-mf2p-h6hf-fcwm TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
High EPSS 0.35% |
>= 7.9.3, < 7.9.4 | 7.9.4 |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
<= 5.10.9 | No fix yet |
| GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
Medium EPSS 0.28% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
<= 5.10.9 | No fix yet |
| GHSA-vg35-5wq7-3x7w TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
Medium EPSS 0.26% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-mh5m-5hw4-5c69 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs |
Medium EPSS 0.19% |
>= 6.8.0, < 7.1.0 | 7.1.0 |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
<= 5.10.9 | No fix yet |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
>= 6.0.0, < 7.9.3 | 7.9.3 |
| GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
Medium EPSS 0.28% |
>= 8.0.0, < 8.5.1 | 8.5.1 |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
>= 6.0.0, < 6.8.4 | 6.8.4 |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
>= 7.0.0, < 7.2.0 | 7.2.0 |
| GHSA-9hcv-j9pv-qmph TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
Medium EPSS 0.53% |
< 5.11.0 | 5.11.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
>= 7.0.0, < 7.2.0 | 7.2.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
< 5.11.0 | 5.11.0 |
| GHSA-w9jx-4g6g-rp7x TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
Medium EPSS 0.53% |
>= 6.0.0, < 6.8.4 | 6.8.4 |
| GHSA-5359-pvf2-pw78 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements |
Medium EPSS 0.71% |
< 7.0.0 | 7.0.0 |
| GHSA-438c-3975-5x3f TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes |
Medium EPSS 0.71% |
< 6.8.1 | 6.8.1 |
| GHSA-wxj2-777f-vxmf Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE plugins Withdrawn |
Medium | all versions | No fix yet |
| GHSA-gjhc-6xm7-mc8q Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE Withdrawn |
Medium | < 5.9.0 | 5.9.0 |
| GHSA-q5pp-5q2h-g8rv Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE Withdrawn |
Medium | all versions | No fix yet |
| GHSA-v626-r774-j7f8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes |
Medium EPSS 0.71% |
< 5.10.9 | 5.10.9 |
| GHSA-v626-r774-j7f8 TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes |
Medium EPSS 0.71% |
>= 6.0.0, < 6.7.3 | 6.7.3 |
| GHSA-hgqx-r2hp-jr38 TinyMCE XSS vulnerability in notificationManager.open API |
Medium EPSS 0.63% |
>= 6.0.0, < 6.7.1 | 6.7.1 |
| GHSA-hgqx-r2hp-jr38 TinyMCE XSS vulnerability in notificationManager.open API |
Medium EPSS 0.63% |
< 5.10.8 | 5.10.8 |
| GHSA-v65r-p3vv-jjfv TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin |
Medium EPSS 0.76% |
>= 6.0.0, < 6.7.1 | 6.7.1 |
| GHSA-v65r-p3vv-jjfv TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin |
Medium EPSS 0.76% |
< 5.10.8 | 5.10.8 |
| GHSA-gg8r-xjwq-4w92 Cross-site scripting vulnerability in TinyMCE alerts |
Medium EPSS 1.01% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-gg8r-xjwq-4w92 Cross-site scripting vulnerability in TinyMCE alerts |
Medium EPSS 1.01% |
< 5.10.7 | 5.10.7 |
| GHSA-r8hm-w5f7-wj39 Cross-site scripting vulnerability in TinyMCE plugins |
Medium EPSS 0.96% |
< 5.10.0 | 5.10.0 |
| GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.07% |
< 5.9.0 | 5.9.0 |
| GHSA-5vm8-hhgr-jcjp Cross-site scripting vulnerability in TinyMCE |
Medium | < 5.7.1 | 5.7.1 |
| GHSA-p7j5-4mwm-hv86 Duplicate Advisory: Cross-site scripting in TinyMCE Withdrawn |
Medium | < 4.9.7 | 4.9.7 |
| GHSA-p7j5-4mwm-hv86 Duplicate Advisory: Cross-site scripting in TinyMCE Withdrawn |
Medium | >= 5.0.0, < 5.1.4 | 5.1.4 |
| GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.17% |
< 5.6.0 | 5.6.0 |
| GHSA-h96f-fc7c-9r55 Regex denial of service vulnerability in codesample plugin |
Low | < 5.6.0 | 5.6.0 |
| GHSA-vrv8-v4w8-f95h Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.80% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-vrv8-v4w8-f95h Cross-site scripting vulnerability in TinyMCE |
Medium EPSS 1.80% |
< 4.9.11 | 4.9.11 |
| GHSA-c78w-2gw7-gjv3 XSS in TinyMCE |
Medium EPSS 1.92% |
>= 5.0.0, < 5.2.2 | 5.2.2 |
| GHSA-c78w-2gw7-gjv3 XSS in TinyMCE |
Medium EPSS 1.92% |
< 4.9.10 | 4.9.10 |
| GHSA-27gm-ghr9-4v95 Cross-site scripting vulnerability in TinyMCE |
High EPSS 1.25% |
>= 5.0.0, < 5.1.4 | 5.1.4 |
| GHSA-27gm-ghr9-4v95 Cross-site scripting vulnerability in TinyMCE |
High EPSS 1.25% |
< 4.9.7 | 4.9.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor