# CVE-2019-1010091: TinyMCE cross-site scripting via clipboard content

Source: https://junglewise.ai/threats/cve-2019-1010091-tinymce-cross-site-scripting-via-clipboard-content  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-05-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-1010091 · Severity: info · CVSS 6.1 · Published 2020-05-11

TinyMCE is a popular rich-text editor component embedded in web applications and content management systems. An attacker can inject malicious JavaScript code through specially crafted clipboard content or API calls, which executes in the browser of any user editing content—potentially allowing account takeover, data theft, or malware distribution to website visitors.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-1010091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-1010091 being exploited in the wild.

**How severe is CVE-2019-1010091?** Informational severity, with a CVSS score of 6.1, published 11 May 2020.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0,fixed=4.9.10.

**Is there a fix for CVE-2019-1010091?** Yes. tinymce (npm): upgrade to 4.9.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-1010091 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-1010091?** Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 4.9.10 or later

  ```sh
  npm install tinymce@4.9.10
  ```


## Technical details

A cross-site scripting (CWE-79) vulnerability exists in the core parser and media plugin due to insufficient HTML sanitization and CDATA handling. An attacker can craft malicious content containing JavaScript and insert it via the clipboard or direct API calls. The vulnerable code fails to properly sanitize or filter CDATA sections during parsing, allowing arbitrary script execution in the context of the editor user's session. The vulnerability was patched in TinyMCE 4.9.10 and 5.2.2 through improved HTML parsing and sanitization logic. Workarounds include disabling the media plugin and manually stripping CDATA elements.

## Affected products

- Tiny Technologies TinyMCE 4.9.9 and lower, 5.0.0 to 5.2.1

## Identifiers

- CVE-2019-1010091
- GHSA-c78w-2gw7-gjv3

## Timeline

- 2020-05-07: disclosed
- 2020-05-07: patched: Patched in TinyMCE 4.9.10 and 5.2.2

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-c78w-2gw7-gjv3](https://github.com/tinymce/tinymce/security/advisories/GHSA-c78w-2gw7-gjv3)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)