# CVE-2023-45819: TinyMCE XSS vulnerability in notificationManager.open API

Source: https://junglewise.ai/threats/cve-2023-45819-tinymce-xss-vulnerability-in-notificationmanager-open-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-45819 · Severity: low · CVSS 3.1 · Published 2023-10-19

TinyMCE is a popular rich-text editor component used in web applications and content management systems. An attacker can exploit an XSS vulnerability in the notification manager to execute arbitrary JavaScript code in a user's browser session, potentially leading to account compromise, data theft, or unauthorized actions performed on behalf of the user.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce), [TinyMCE (NuGet)](https://junglewise.ai/threats/technologies/nuget-tinymce), [tinymce/tinymce (Packagist)](https://junglewise.ai/threats/technologies/tinymce-tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-45819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-45819 being exploited in the wild.

**How severe is CVE-2023-45819?** Low severity, with a CVSS score of 3.1, published 19 October 2023.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=6.0.0,fixed=6.7.1; TinyMCE (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1.

**Is there a fix for CVE-2023-45819?** Yes. tinymce (npm): upgrade to 6.7.1 or later; TinyMCE (NuGet): upgrade to 6.7.1 or later; tinymce/tinymce (Packagist): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-45819 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-45819?** Check whether you run tinymce (npm), TinyMCE (NuGet) or tinymce/tinymce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 6.7.1 or later

  ```sh
  npm install tinymce@6.7.1
  ```

- TinyMCE (NuGet): upgrade to 6.7.1 or later

  ```sh
  dotnet add package TinyMCE --version 6.7.1
  ```

- tinymce/tinymce (Packagist): upgrade to 6.7.1 or later

  ```sh
  composer require tinymce/tinymce:^6.7.1
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in TinyMCE's Notification Manager API (notificationManager.open) due to unfiltered HTML rendering in notification messages. The vulnerability is triggered when malicious content is inserted into the editor and a notification is subsequently displayed; the text parameter's HTML is rendered without sanitization, allowing arbitrary JavaScript execution in the user's browser context. Attack requires user interaction (triggering a notification) and network access to a TinyMCE-enabled application, but no authentication or special privileges. The vulnerability affects TinyMCE versions prior to 5.10.8 and 6.7.1. Patches are available and have been released to both major version branches.

## Affected products

- Tiny Technologies TinyMCE < 5.10.8, >= 6.0.0 and < 6.7.1

## Identifiers

- CVE-2023-45819
- GHSA-hgqx-r2hp-jr38

## Timeline

- 2023-10-19: disclosed: Advisory GHSA-hgqx-r2hp-jr38 published
- 2023-10-19: patched: TinyMCE 5.10.8 and 6.7.1 released with patches

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-hgqx-r2hp-jr38](https://github.com/tinymce/tinymce/security/advisories/GHSA-hgqx-r2hp-jr38)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)