{"id":"CVE-2026-116675","aliases":["GHSA-mf2p-h6hf-fcwm"],"url":"https://o3.security/vulnerability/CVE-2026-116675","summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","details":"### Impact\nStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.\n\n### Workarounds\nNo official workaround available.\n\n### Fix\nTo avoid this vulnerability:\n\nUpgrade to TinyMCE 8.9.3 or higher.\nUpgrade to TinyMCE 7.9.4 or higher.\n\n### Acknowledgements\nTiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.","published":"2026-10-27T16:47:01.183Z","modified":"2026-10-28T02:54:50.057336909Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"tinymce","fixedVersion":"8.9.3"},{"ecosystem":"npm","name":"tinymce","fixedVersion":"7.9.4"},{"ecosystem":"NuGet","name":"TinyMCE","fixedVersion":"8.9.3"},{"ecosystem":"NuGet","name":"TinyMCE","fixedVersion":"7.9.4"},{"ecosystem":"Packagist","name":"tinymce/tinymce","fixedVersion":"8.9.3"},{"ecosystem":"Packagist","name":"tinymce/tinymce","fixedVersion":"7.9.4"}],"fix":{"url":"https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2","label":"tinymce/tinymce@bd1ab5e"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116675.json"},{"type":"FIX","url":"https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2"},{"type":"WEB","url":"https://github.com/tinymce/tinymce/releases/tag/8.9.3"},{"type":"ADVISORY","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116675"},{"type":"WEB","url":"https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview"},{"type":"WEB","url":"https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview"},{"type":"PACKAGE","url":"https://github.com/tinymce/tinymce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:54:50.057336909Z"}}