Vulnerability Directory | CVE-2026-47759

Overview

TinyMCE is a popular open-source, web-based rich text editor (WYSIWYG) that allows developers to embed an editable content area into web applications. It converts HTML elements into editable regions and provides a wide range of formatting, content insertion, and plugin capabilities.

A high-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-47759) has been identified in TinyMCE. The editor uses internal data-mce- prefixed attributes such as data-mce-href, data-mce-src, and data-mce-style to retain original values during editing. An attacker can supply content that pairs a safe normal attribute with a malicious prefixed attribute (for example a data-mce-href carrying a javascript: URL). The parser validates the safe attribute but preserves the unsanitized prefixed value, and TinyMCE later serializes that prefixed value back into the unprefixed attribute, so the stored content can execute arbitrary JavaScript when rendered.

Per OWASP, Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites; they occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user.

Details

Module Info

Product: TinyMCE
Affected packages: tinymce
Affected versions: <5.11.1, >=6.0.0 <7.9.3, >=8.0.0 <8.5.1
GitHub repository: https://github.com/tinymce/tinymce
Published packages: https://www.npmjs.com/package/tinymce
Package manager: npm
Fixed in:
OSS v7.9.3
OSS v8.5.1
NES for TinyMCE v6.8.9

Vulnerability Info

This high-severity vulnerability allows stored XSS through unsanitized data-mce- prefixed attributes.

TinyMCE retains certain original attribute values internally using data-mce- prefixed copies. The vulnerable parser validates the visible, unprefixed attribute but does not sanitize the prefixed counterpart. During serialization, TinyMCE restores the retained data-mce-href, data-mce-src, and data-mce-style values back into the live href, src, and style attributes, overriding the validated value with attacker-controlled content.

This vulnerability could be exploited by:

supplying a safe unprefixed attribute alongside a malicious data-mce-href, data-mce-src, or data-mce-style attribute
embedding a javascript: URL or other script payload in the prefixed attribute
storing the content so it executes when the serialized output is later rendered and interacted with

The upstream fix adds a parser attribute filter that strips data-mce-src, data-mce-href, and data-mce-style before TinyMCE's retained-attribute handling can restore them during serialization.