CVE-2026-116675 — 脆弱性インテリジェンス
PHP / Composer — tinymce, TinyMCE, tinymce/tinymce, tinymce, TinyMCE, tinymce/tinymce
公表日:
- CVSS
- 0
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
### Impact
Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.
### Patches
This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.
### Workarounds
No official workaround available.
### Fix
To avoid this vulnerability:
Upgrade to TinyMCE 8.9.3 or higher.
Upgrade to TinyMCE 7.9.4 or higher.
### Acknowledgements
Tiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.