{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"},"package":{"ecosystem":"npm","name":"tinymce","purl":"pkg:npm/tinymce"},"ranges":[{"events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}],"type":"SEMVER"}]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"},"package":{"ecosystem":"NuGet","name":"TinyMCE","purl":"pkg:nuget/TinyMCE"},"ranges":[{"events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}],"type":"ECOSYSTEM"}],"versions":["6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh5m-5hw4-5c69/GHSA-mh5m-5hw4-5c69.json"},"package":{"ecosystem":"Packagist","name":"tinymce/tinymce","purl":"pkg:composer/tinymce/tinymce"},"ranges":[{"events":[{"introduced":"6.8.0"},{"fixed":"7.1.0"}],"type":"ECOSYSTEM"}],"versions":["6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1"]}],"aliases":["CVE-2026-47760"],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-06-05T20:09:38Z","nvd_published_at":"2026-05-28T16:16:28Z","severity":"HIGH"},"details":"### Impact\nTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg> elements can bypass attribute sanitization and execute arbitrary JavaScript.\n\n### Patches\nThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.\n\n### Workarounds\nNo official workaround available.\n\n### Acknowledgements\nTiny thanks [maple3142](https://github.com/maple3142) (<https://maple3142.net>) of DEVCORE for their help identifying this vulnerability.\n\n### References\nFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.","id":"GHSA-mh5m-5hw4-5c69","modified":"2026-09-10T03:51:09.366977370Z","published":"2026-06-05T20:09:38Z","references":[{"type":"WEB","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47760"},{"type":"PACKAGE","url":"https://github.com/tinymce/tinymce"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","type":"CVSS_V3"}],"summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs"}