{"schema":"threatline.record/2","record":{"id":"CVE-2026-116675","aliases":["GHSA-mf2p-h6hf-fcwm"],"summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","details":"### Impact\nStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.\n\n### Workarounds\nNo official workaround available.\n\n### Fix\nTo avoid this vulnerability:\n\nUpgrade to TinyMCE 8.9.3 or higher.\nUpgrade to TinyMCE 7.9.4 or higher.\n\n### Acknowledgements\nTiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.","categories":["Libraries & packages"],"product":"tinymce","vendor":"tinymce","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"npm","name":"tinymce"},"range":">= 8.5.1, < 8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"nuget","name":"TinyMCE"},"range":">= 8.5.1, < 8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"tinymce/tinymce"},"range":">= 8.5.1, < 8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"npm","name":"tinymce"},"range":"= 7.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"nuget","name":"TinyMCE"},"range":"= 7.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"tinymce/tinymce"},"range":"= 7.9.3"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116675","source_modified_at":"2026-10-27T16:47:01.183Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"tinymce","vendor":"tinymce","versions":[{"version":">= 8.5.1, < 8.9.3","status":"affected"},{"version":">= 7.9.3, < 7.9.4","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.1"},{"fixed":"8.9.3"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"TinyMCE","ecosystem":"NuGet","purl":"pkg:nuget/TinyMCE"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.1"},{"fixed":"8.9.3"}]}],"versions":["8.5.1","8.6.0","8.7.0","8.8.0","8.8.1","8.8.2","8.9.0","8.9.1","8.9.2"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce/tinymce","ecosystem":"Packagist","purl":"pkg:composer/tinymce/tinymce"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.1"},{"fixed":"8.9.3"}]}],"versions":["8.5.1","8.6.0","8.7.0","8.8.0","8.8.1","8.8.2","8.9.0","8.9.1","8.9.2"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.9.3"},{"fixed":"7.9.4"}]}],"versions":["7.9.3"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"TinyMCE","ecosystem":"NuGet","purl":"pkg:nuget/TinyMCE"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.9.3"},{"fixed":"7.9.4"}]}],"versions":["7.9.3"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce/tinymce","ecosystem":"Packagist","purl":"pkg:composer/tinymce/tinymce"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.9.3"},{"fixed":"7.9.4"}]}],"versions":["7.9.3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"npm","name":"tinymce"},"version":"8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"nuget","name":"TinyMCE"},"version":"8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"tinymce/tinymce"},"version":"8.9.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"npm","name":"tinymce"},"version":"7.9.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"nuget","name":"TinyMCE"},"version":"7.9.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:07:13Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"composer","name":"tinymce/tinymce"},"version":"7.9.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"version":"8.9.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"TinyMCE","ecosystem":"NuGet","purl":"pkg:nuget/TinyMCE"},"version":"8.9.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce/tinymce","ecosystem":"Packagist","purl":"pkg:composer/tinymce/tinymce"},"version":"8.9.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce","ecosystem":"npm","purl":"pkg:npm/tinymce"},"version":"7.9.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"TinyMCE","ecosystem":"NuGet","purl":"pkg:nuget/TinyMCE"},"version":"7.9.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","source_modified_at":"2026-10-27T21:15:04.912450737Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"tinymce/tinymce","ecosystem":"Packagist","purl":"pkg:composer/tinymce/tinymce"},"version":"7.9.4"}],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T16:47:01.183Z","modified_at":"2026-10-27T21:15:04.912450737Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T21:07:13Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116675","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T16:47:01.183Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-mf2p-h6hf-fcwm","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T21:15:04.912450737Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116675","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tinymce/tinymce/releases/tag/8.9.3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-mf2p-h6hf-fcwm","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T21:15:04.912450737Z","content_hash":"2fed0860bff86130e4cd8d0bfd367beb93c964c5bc6cac57ffe41b3f36719f67"}}