CVE-2026-47759: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47759 is a stored Cross-Site Scripting (XSS) vulnerability in TinyMCE, an open-source rich text editor, caused by unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Attackers with editor-level access can inject malicious values via these attributes that override safe attributes during HTML serialization, bypassing TinyMCE's built-in validation. The vulnerability was published on May 20, 2026, and affects TinyMCE versions prior to 5.11.1, versions 6.0.0–6.8.6, versions 7.0.0–7.9.2, and versions 8.0.0–8.5.0. The GitHub Advisory Database rates this as High severity with a CVSS v3.1 score of 8.7, while NVD assigns a score of 5.4 (Medium) (GitHub Advisory, TinyMCE Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). TinyMCE uses internal data-mce-* attributes (e.g., data-mce-href, data-mce-src, data-mce-style) as working copies of standard HTML attributes during editing; however, prior to the fix, these attributes were not stripped or sanitized during the parsing/serialization phase. An authenticated attacker with editing permissions can craft HTML content containing malicious data-mce-* attribute values (e.g., javascript: URIs or event handler payloads) that override the corresponding safe attributes when the editor serializes content for output, effectively bypassing the editor's XSS filters. The fix addresses this by stripping unsafe data-mce-* attributes during parsing (GitHub Advisory, TinyMCE Advisory).

Successful exploitation allows an authenticated user with editing permissions to inject persistent malicious HTML and JavaScript that is stored in the application and executes in the browsers of other users who view the affected content. The scope change (S:C) in the CVSS vector reflects that the injected script executes in the victim's browser context, potentially enabling session hijacking, credential theft, unauthorized actions on behalf of the victim, or further lateral movement within the application. Confidentiality and integrity of affected users' data are both at risk, though availability is not directly impacted (GitHub Advisory, TinyMCE Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (GitHub Advisory). Exploitation requires low privileges (authenticated editor access) and user interaction (a victim must view the malicious content), which limits opportunistic mass exploitation. The EPSS score is approximately 0.032%, placing it in the 10th percentile for exploitation likelihood within 30 days. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability.

1. Gain editor access: Obtain an account with TinyMCE editor permissions on the target application (e.g., a CMS, blog platform, or web application using a vulnerable TinyMCE version).
2. Craft malicious content: Compose HTML content that includes a data-mce-href, data-mce-src, or data-mce-style attribute containing a malicious payload, such as <a href="safe-url" data-mce-href="javascript:alert(document.cookie)">Click me</a> or an <img> tag with data-mce-src set to a JavaScript URI.
3. Submit content: Save or publish the crafted content through the TinyMCE editor interface. The malicious data-mce-* attribute value overrides the safe attribute during serialization, persisting the payload in the stored content.
4. Trigger victim execution: Wait for another user (e.g., an administrator or site visitor) to view the page containing the injected content. The victim's browser executes the injected JavaScript in the application's origin context.
5. Achieve objective: Use the executed script to steal session cookies, perform actions on behalf of the victim, exfiltrate sensitive data, or redirect the victim to a phishing page (TinyMCE Advisory, GitHub Advisory).

• Network: Unexpected outbound requests from victim browsers to attacker-controlled domains following interaction with TinyMCE-rendered content; unusual POST requests containing data-mce-href, data-mce-src, or data-mce-style attributes with javascript: URIs or encoded payloads.
• Logs: Application or web server logs showing submission of content containing data-mce-href, data-mce-src, or data-mce-style attributes with non-standard values (e.g., javascript:, vbscript:, or inline event handlers); browser console errors related to Content Security Policy violations triggered by injected scripts.
• File System / Database: Stored content in the application database containing data-mce-href, data-mce-src, or data-mce-style attributes with suspicious values such as javascript: URIs, base64-encoded payloads, or external script references.

Upgrade TinyMCE to one of the patched versions: 5.11.1 (LTS, available under commercial support), 7.9.3, or 8.5.1. The fix strips unsafe data-mce-* attributes during parsing, preventing malicious values from overriding safe attributes at serialization. No official workaround is available for users who cannot upgrade immediately; as interim measures, restrict TinyMCE editor access to trusted users only and implement a strict Content Security Policy (CSP) to limit the impact of any injected scripts (TinyMCE Advisory, GitHub Advisory).

The vulnerability was credited to researchers Tadi Kadango and Ivan Babenko, who were acknowledged by Tiny in the official advisory (TinyMCE Advisory). Security news outlet The Hacker Wire covered the disclosure, highlighting the attribute-bypass mechanism (The Hacker Wire). SecurityOnline.info also published coverage of the patch (SecurityOnline). Community discussion was noted on Bluesky and LinkedIn, though no significant controversy or widespread alarm was observed given the absence of active exploitation.