npm/tinymce CVE-2026-47760: high 8.7, EPSS 0.19%

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Action: Upgrade tinymce to 7.1.0 or later.

npm i tinymce@7.1.0

Affected

Fixed versions

Sources

• osv: GHSA-mh5m-5hw4-5c69
• https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69
• https://nvd.nist.gov/vuln/detail/CVE-2026-47760
• https://github.com/tinymce/tinymce

CVE-2026-47760 · published 2026-06-05T20:09:38Z · modified 2026-09-10T03:51:09.366977370Z · JSON