# TinyMCE cross-site scripting in URL sanitization

Source: https://junglewise.ai/threats/tinymce-cross-site-scripting-in-url-sanitization-a8b8859f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · CVSS 6.1 · Published 2024-01-03

TinyMCE is a popular rich-text editor embedded in web applications and content management systems. A cross-site scripting (XSS) flaw in its URL sanitization logic allows attackers to inject malicious JavaScript code through specially crafted content, which executes in the browsers of other users viewing that content. This can lead to session hijacking, credential theft, or malware distribution.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 6.1, published 3 January 2024.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0.

**Is there a fix for This vulnerability?** A patch was published on 2021-01-06: Version 5.6.0 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw in the URL sanitization logic of TinyMCE's core parser, affecting versions before 5.6.0. An unauthenticated attacker can insert crafted HTML (via clipboard, APIs, or other content insertion mechanisms) containing malicious JavaScript in iframe, object, or embed element URL attributes. The crafted content persists in the editor and executes arbitrary JavaScript in the context of other users' browsers when they view or edit the content. The vulnerability was patched in version 5.6.0 through improved URL sanitization logic. Workarounds include using node filters to sanitize specific attributes or disabling problematic elements entirely via the invalid_elements configuration.

## Affected products

- Tiny Technologies TinyMCE < 5.6.0

## Timeline

- 2021-01-06: disclosed
- 2021-01-06: patched: Version 5.6.0 released with patch
- 2024-01-03: advisory: Advisory republished as GHSA-q5pp-5q2h-g8rv (duplicate of GHSA-w7jx-j77m-wp65)

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-w7jx-j77m-wp65](https://github.com/tinymce/tinymce/security/advisories/GHSA-w7jx-j77m-wp65)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)