GHSA-hgqx-r2hp-jr38
MEDIUMGHSA-hgqx-r2hp-jr38 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in tinymce. O3 Security confirms whether GHSA-hgqx-r2hp-jr38 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
TinyMCE XSS vulnerability in notificationManager.open API
Blast Radius
tinymce📦tinymce.NETTinyMCE.NETTinyMCE🐘tinymce/tinymce🐘tinymce/tinymceReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm, NuGet packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered.
When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when an notification presented in the TinyMCE UI for the current user. This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content.
Patches
This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit.
Fix
To avoid this vulnerability:
- Upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x.
- Upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.
References
- https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
- https://tiny.cloud/docs/tinymce/6/6.7.1-release-notes/#security-fixes
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Open an issue in the TinyMCE repo
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | tinymce | ≥ 6.0.0&&< 6.7.1 | 6.7.1 |
| 📦npm | tinymce | all versions | 5.10.8 |
| .NETNuGet | TinyMCE | ≥ 6.0.0&&< 6.7.1 | 6.7.1 |
| .NETNuGet | TinyMCE | all versions | 5.10.8 |
| 🐘Packagist | tinymce/tinymce | ≥ 6.0.0&&< 6.7.1 | 6.7.1 |
| 🐘Packagist | tinymce/tinymce | all versions | 5.10.8 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tinymce. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update tinymce to 6.7.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hgqx-r2hp-jr38 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-hgqx-r2hp-jr38 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-hgqx-r2hp-jr38. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-hgqx-r2hp-jr38 in your dependencies?
O3 detects GHSA-hgqx-r2hp-jr38 across npm, NuGet, Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.