# CVE-2023-45818: TinyMCE mutation XSS in undo/redo and content APIs

Source: https://junglewise.ai/threats/cve-2023-45818-tinymce-mutation-xss-in-undo-redo-and-content-apis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-45818 · Severity: low · CVSS 3.1 · Published 2023-10-19

TinyMCE is a widely-used rich text editor embedded in web applications. A mutation cross-site scripting (mXSS) vulnerability allows attackers to bypass the editor's HTML sanitization through manipulation of undo/redo operations and related APIs. By restoring carefully-crafted HTML from the undo stack, malicious JavaScript can be executed in the context of the user's browser, potentially compromising data and sessions.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce), [TinyMCE (NuGet)](https://junglewise.ai/threats/technologies/nuget-tinymce), [tinymce/tinymce (Packagist)](https://junglewise.ai/threats/technologies/tinymce-tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-45818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-45818 being exploited in the wild.

**How severe is CVE-2023-45818?** Low severity, with a CVSS score of 3.1, published 19 October 2023.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=6.0.0,fixed=6.7.1; TinyMCE (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1.

**Is there a fix for CVE-2023-45818?** Yes. tinymce (npm): upgrade to 6.7.1 or later; TinyMCE (NuGet): upgrade to 6.7.1 or later; tinymce/tinymce (Packagist): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-45818 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-45818?** Check whether you run tinymce (npm), TinyMCE (NuGet) or tinymce/tinymce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 6.7.1 or later

  ```sh
  npm install tinymce@6.7.1
  ```

- TinyMCE (NuGet): upgrade to 6.7.1 or later

  ```sh
  dotnet add package TinyMCE --version 6.7.1
  ```

- tinymce/tinymce (Packagist): upgrade to 6.7.1 or later

  ```sh
  composer require tinymce/tinymce:^6.7.1
  ```


## Technical details

This mXSS vulnerability exists in TinyMCE's undo/redo functionality, getContent API (raw format), resetContent API, and Autosave plugin. The root cause is the use of string-level HTML trimming before storing content in the undo stack. When content is restored, browser parsing (via DOMParser in TinyMCE 6 or SaxParser in TinyMCE 5) mutates the carefully-crafted HTML snippet, transforming sanitized markup into executable XSS payload. Attack requires user interaction (triggering undo/redo or using affected APIs) and network-accessible TinyMCE instance, but no authentication. The vulnerability has been patched in TinyMCE 5.10.8 and 6.7.1 by switching to node-level HTML manipulation instead of string manipulation.

## Affected products

- Tiny Technologies TinyMCE all versions before 5.10.8 and 6.0.0–6.7.0

## Identifiers

- CVE-2023-45818
- GHSA-v65r-p3vv-jjfv

## Timeline

- 2023-10-19: disclosed
- 2023-10-19: patched: TinyMCE 5.10.8 and 6.7.1 released with fix

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv](https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)