TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in…

Published:

27 mei 2026 om 22:00:00

Alert date:

28 mei 2026 om 20:05:25

Source:

nvd.nist.gov

Web Technologies

TinyMCE versions 6.8.0 to before 7.1.0 contain a cross-site scripting (XSS) vulnerability in the SVG sanitizer. The vulnerability stems from improper SVG namespace scope handling, allowing attackers to craft payloads using nested elements that bypass attribute sanitization. This enables execution of arbitrary JavaScript code in the context of the application. The vulnerability has been patched in version 7.1.0.

Technical details

Mitigation steps:

Affected products:

TinyMCE