CVE-2026-47761: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Synopsis

Stored cross-site scripting (XSS) vulnerability in TinyMCE's media plugin allows an authenticated attacker to inject malicious scripts via crafted data-mce-* attributes in media embed content. The attack is reachable over the network and requires a low-privilege account; a victim must load or view the affected content for the injected script to execute. Successful exploitation gives the attacker full read and write access to the victim's session context, including the ability to exfiltrate data or perform actions on their behalf. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TinyMCE-powered application over the network to submit the crafted media content (CVSS AV:N).

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to submit content through the editor (CVSS PR:L).

• Victim interactionRequired

  A victim must open or render the page containing the injected content for the malicious script to execute (CVSS UI:R).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental factors required (CVSS AC:L).

Blast Radius

• Reads session tokens, cookies, and other credentials accessible to the victim's browser context.
• Reads sensitive page content and data visible to the logged-in victim, including any customer records or private information rendered on the page.
• Performs authenticated actions in the application on the victim's behalf, such as modifying stored content, changing account settings, or submitting forms.