# CVE-2023-48219: TinyMCE mutation cross-site scripting via unescaped text nodes

Source: https://junglewise.ai/threats/cve-2023-48219-tinymce-mutation-cross-site-scripting-via-unescaped-text-nodes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-11-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-48219 · Severity: low · CVSS 3.1 · Published 2023-11-15

TinyMCE is a popular rich-text editor component used in web applications and content management systems. A mutation cross-site scripting (mXSS) vulnerability allows attackers to craft malicious content that bypasses initial sanitization checks and executes arbitrary JavaScript when the editor's undo/redo function or certain APIs process the content. This can lead to theft of user data, session hijacking, or malware injection in affected web applications.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce), [TinyMCE (NuGet)](https://junglewise.ai/threats/technologies/nuget-tinymce), [tinymce/tinymce (Packagist)](https://junglewise.ai/threats/technologies/tinymce-tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2023-48219 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-48219 being exploited in the wild.

**How severe is CVE-2023-48219?** Low severity, with a CVSS score of 3.1, published 15 November 2023.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0,fixed=5.10.9; TinyMCE (NuGet) ECOSYSTEM:introduced=0,fixed=5.10.9; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=0,fixed=5.10.9.

**Is there a fix for CVE-2023-48219?** Yes. tinymce (npm): upgrade to 5.10.9 or later; TinyMCE (NuGet): upgrade to 5.10.9 or later; tinymce/tinymce (Packagist): upgrade to 5.10.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-48219 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-48219?** Check whether you run tinymce (npm), TinyMCE (NuGet) or tinymce/tinymce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 5.10.9 or later

  ```sh
  npm install tinymce@5.10.9
  ```

- TinyMCE (NuGet): upgrade to 5.10.9 or later

  ```sh
  dotnet add package TinyMCE --version 5.10.9
  ```

- tinymce/tinymce (Packagist): upgrade to 5.10.9 or later

  ```sh
  composer require tinymce/tinymce:^5.10.9
  ```


## Technical details

The vulnerability is a mutation cross-site scripting (mXSS) issue in TinyMCE's serialization and parsing logic. Text nodes within specific parent elements are not properly escaped according to HTML standards. When such text nodes contain a special internal marker character, they can be combined with other HTML patterns to create malicious payloads that pass initial sanitization but trigger XSS when the marker is removed and content is re-parsed. The vulnerability affects the core undo/redo functionality and specific APIs (getContent, resetContent) as well as the Autosave plugin. It requires user interaction to trigger (typically editing and saving content) but no authentication. The vulnerability has been patched in TinyMCE 6.7.3 and 5.10.9.

## Affected products

- Tiny Technologies TinyMCE Before 5.10.9, 6.0.0 before 6.7.3

## Identifiers

- CVE-2023-48219
- GHSA-v626-r774-j7f8

## Timeline

- 2023-11-15: disclosed
- 2023-11-15: patched: TinyMCE 5.10.9 and 6.7.3 released

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8](https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)