{"id":"CVE-2026-47760","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T16:16:28.210","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0."},{"lang":"es","value":"TinyMCE es un editor de texto enriquecido de código abierto. Desde la 6.8.0 hasta antes de la 7.1.0, TinyMCE contiene una vulnerabilidad XSS causada por un manejo inadecuado del ámbito del espacio de nombres SVG en el saneador. Una carga útil manipulada que utiliza elementos anidados puede eludir la sanitización de atributos y ejecutar JavaScript arbitrario. Esta vulnerabilidad está corregida en la 7.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tinymce","product":"tinymce","versions":[{"version":">= 6.0.0, < 7.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-02T15:57:38.689171Z","id":"CVE-2026-47760","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8.0","versionEndExcluding":"7.1.0","matchCriteriaId":"D4034B9F-041D-4ACE-9BC6-9170FE25E725"}]}]}],"references":[{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}