TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsGHSA-v98h-vmpc-fpqv
HIGHGHSA-v98h-vmpc-fpqv is a high-severity (CVSS 8.7) Cross-site Scripting (XSS) vulnerability in tinymce. A fix is available for tinymce — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-v98h-vmpc-fpqv.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-v98h-vmpc-fpqv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 391,411 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
tinymcenpmDescription
Impact
Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.
Patches
Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.
Workarounds
No official workaround available.
Fix
To avoid this vulnerability:
Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).
Acknowledgements
Tiny thanks Ivan Babenko for their help identifying this vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | tinymce | all versions | No fix |
| 📦npm | tinymce | ≥ 6.0.0&&< 7.9.3 | 7.9.3npm install tinymce@7.9.3 |
| 📦npm | tinymce | ≥ 8.0.0&&< 8.5.1 | 8.5.1npm install tinymce@8.5.1 |
| .NETNuGet | TinyMCE | all versions | No fix |
| .NETNuGet | TinyMCE | ≥ 6.0.0&&< 7.9.3 | 7.9.3dotnet add package TinyMCE --version 7.9.3 |
| .NETNuGet | TinyMCE | ≥ 8.0.0&&< 8.5.1 | 8.5.1dotnet add package TinyMCE --version 8.5.1 |
Affected Products
tinymcetinyDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tinymce, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
No patched version of tinymce has shipped for GHSA-v98h-vmpc-fpqv yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is GHSA-v98h-vmpc-fpqv in your dependencies?
Find it across npm, NuGet, Packagist, including transitive dependencies.