CVE-2026-47760

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47760
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47760.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-47760
Aliases
Downstream
Published
2026-05-28T15:18:22.509Z
Modified
2026-07-11T03:54:41.723853252Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Details

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47760.json"
}
References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
4cc623897917472ba418f1378170727d7a94575b
Fixed
d1f9346bc98acb3cdfe700e6e6fd310f356ef2b8
Database specific 
{
    "cpe": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "7.1.0"
        },
        {
            "introduced": "6.8.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47760.json"