TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in…

Published:

27 mei 2026 om 22:00:00

Alert date:

28 mei 2026 om 19:09:38

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

TinyMCE versions 6.8.0 to before 7.1.0 contain an XSS vulnerability due to improper SVG namespace scope handling in the sanitizer. Attackers can craft payloads using nested SVG elements to bypass attribute sanitization and execute arbitrary JavaScript. This cross-site scripting vulnerability affects the open source rich text editor's security controls. The vulnerability has been patched in version 7.1.0. Organizations using affected versions should upgrade immediately to prevent potential exploitation.

Technical details

Mitigation steps:

Affected products:

TinyMCE