tinymce
npm
SEMVER · introduced 8.5.1 → fixed 8.9.3
GHSA-mf2p-h6hf-fcwmPublished
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
Exact source revision recorded 27 Oct 2026 21:46:19 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-mf2p-h6hf-fcwm
PublishedTinyMCE
NuGet
ECOSYSTEM · introduced 8.5.1 → fixed 8.9.3
9 explicitly affected versions
8.5.1, 8.6.0, 8.7.0, 8.8.0, 8.8.1, 8.8.2, 8.9.0, 8.9.1, 8.9.2
tinymce/tinymce
Packagist
ECOSYSTEM · introduced 8.5.1 → fixed 8.9.3
9 explicitly affected versions
8.5.1, 8.6.0, 8.7.0, 8.8.0, 8.8.1, 8.8.2, 8.9.0, 8.9.1, 8.9.2
tinymce
npm
SEMVER · introduced 7.9.3 → fixed 7.9.4
1 explicitly affected versions
7.9.3
TinyMCE
NuGet
ECOSYSTEM · introduced 7.9.3 → fixed 7.9.4
1 explicitly affected versions
7.9.3
tinymce/tinymce
Packagist
ECOSYSTEM · introduced 7.9.3 → fixed 7.9.4
1 explicitly affected versions
7.9.3
Original source record · Cite this exact observation · Complete original publisher JSON