CVE-2026-47760: TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Synopsis

A stored cross-site scripting (XSS) vulnerability exists in TinyMCE versions 6.0.0 through 7.0.x, caused by improper SVG namespace scope handling in the editor's HTML sanitizer. An authenticated attacker can craft a nested SVG payload that bypasses attribute sanitization and injects arbitrary JavaScript into content rendered by the editor. Successful exploitation gives the attacker control over victim sessions and allows arbitrary actions in the context of the affected web application. A patched-image rebuild at version 7.1.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the application hosting the TinyMCE editor over the network to deliver and store the crafted SVG payload.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account with permission to submit content through the TinyMCE editor.

• Victim interactionRequired

  A victim user must open or view the page containing the attacker-crafted content for the injected JavaScript to execute in their browser session.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker has editor access; no race conditions or special memory layout requirements are needed.

Blast Radius

• An attacker reads the victim's session tokens, cookies, and any credentials or sensitive data accessible in the browser context.
• The attacker performs arbitrary actions inside the web application on behalf of the victim, including modifying stored content or account settings.
• If the affected editor is embedded in an admin interface, the attacker gains the same elevated application privileges held by the victim at the time of exploitation.