Vulnerability Directory | CVE-2026-47760

Overview

TinyMCE is a popular open-source, web-based rich text editor (WYSIWYG) that allows developers to embed an editable content area into web applications. It converts HTML elements into editable regions and provides a wide range of formatting, content insertion, and plugin capabilities.

A high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-47760) has been identified in TinyMCE's sanitizer due to improper SVG namespace scope handling. A crafted payload that begins with nested <svg> elements can leave the sanitizer treating a following HTML sibling as SVG-scoped, allowing an attacker-controlled event attribute to survive sanitization. When the sanitized output is later rendered, the event handler executes arbitrary JavaScript in the page context.

Per OWASP, Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites; they occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user.

Details

Module Info

Product: TinyMCE
Affected packages: tinymce
Affected versions: >=6.8.0 <7.1.0
GitHub repository: https://github.com/tinymce/tinymce
Published packages: https://www.npmjs.com/package/tinymce
Package manager: npm
Fixed in:
OSS v7.1.0
NES for TinyMCE v6.8.9

Vulnerability Info

This high-severity vulnerability allows sanitization bypass and XSS through nested SVG namespace confusion.

TinyMCE's sanitizer tracks the SVG namespace scope as it walks parsed content so that SVG-specific elements and attributes are handled differently from HTML. A payload that opens nested <svg> elements can corrupt this namespace tracking, so that an HTML element following the SVG block is incorrectly treated as still being SVG-scoped. Because of this scope confusion, an attacker-controlled event attribute on the following element is not stripped during sanitization.

This vulnerability could be exploited by:

supplying content that begins with nested <svg> elements (for example two nested, empty SVG elements)
following the nested SVG block with an HTML element that carries a malicious event handler (such as an image element with an onerror handler)
having the sanitized output rendered, at which point the surviving event handler executes

The upstream fix corrects the namespace scope tracking through a rewrite of the affected sanitizer code.