CVE-2026-116675: CVE-2026-116675: Stored Cross-Site Scripting in TinyMCE Media Plugin via Pre-Sanitization DOM Instantiation

#security #cve #cybersecurity

CVE-2026-116675: Stored Cross-Site Scripting in TinyMCE Media Plugin via Pre-Sanitization DOM Instantiation

Vulnerability ID: CVE-2026-116675
CVSS Score: 8.5
Published: 2026-10-27

CVE-2026-116675 is a stored Cross-Site Scripting (XSS) vulnerability in the TinyMCE rich text editor affecting versions 7.9.3 and 8.5.1 through 8.9.2. The flaw resides in the media plugin's serialization logic, where placeholder elements configured with the data-mce-object attribute are converted into real DOM elements using the active window's document context prior to sanitization. When an attacker supplies a media element with an invalid source attribute alongside an inline event handler attribute such as data-mce-p-onerror, the browser resolves the resource and executes the malicious JavaScript before the sanitizer can strip the dangerous attributes.

TL;DR

TinyMCE's media plugin instantiates HTML elements from data-mce-object placeholders inside the active, scripting-enabled document before sanitization occurs. Attackers can inject stored XSS payloads using data-mce-p-onerror attributes on video, audio, or img placeholders. Users must upgrade to TinyMCE 7.9.4 or 8.9.3, or disable the media plugin.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Stored Cross-Site Scripting (CWE-79)
CVSS v4.0 Score: 8.5 HIGH (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N)
Affected Component: TinyMCE Media Plugin (FilterContent.ts)
Vulnerable Versions: 7.9.3, and 8.5.1 through 8.9.2
Patched Versions: 7.9.4 and 8.9.3
Attack Vector: Crafted data-mce-object and data-mce-p-onerror attributes
Exploit Status: Public PoC Available (Unit Tests)
CISA KEV Status: Not Listed

Affected Systems

TinyMCE Rich Text Editor (npm: tinymce)
TinyMCE NuGet Package (NuGet: TinyMCE)
TinyMCE Composer Package (Packagist: tinymce/tinymce)
TinyMCE: >= 7.9.3, < 7.9.4 (Fixed in: 7.9.4)
TinyMCE: >= 8.5.1, < 8.9.3 (Fixed in: 8.9.3)

Code Analysis

Commit: bd1ab5e

TINYMCE-14932: Fixed media plugin onload/onerror script execution (#1948)

diff --git a/modules/tinymce/src/plugins/media/main/ts/core/FilterContent.ts b/modules/tinymce/src/plugins/media/main/ts/core/FilterContent.ts
index ad0c9a2774a..3b37572e2e7 100644
--- a/modules/tinymce/src/plugins/media/main/ts/core/FilterContent.ts
+++ b/modules/tinymce/src/plugins/media/main/ts/core/FilterContent.ts
@@ -8,9 +8,21 @@ import * as Sanitize from './Sanitize';

 declare let unescape: any;

+let nonNonScriptingDocument: Document;
+
+const createNonScriptingDocument = () => {
+  if (Type.isNonNullable(nonNonScriptingDocument)) {
+    return nonNonScriptingDocument;
+  }
+
+  nonNonScriptingDocument = new DOMParser().parseFromString('', 'text/html');
+  return nonNonScriptingDocument;
+};
+
 const buildMediaElement = (editor: Editor, node: AstNode) => {
+  const doc = createNonScriptingDocument();
   const realElmName = node.attr('data-mce-object') as string;
-  const element = document.createElement(realElmName);
+  const element = doc.createElement(realElmName);

   // Add width/height to everything but audio
   if (realElmName !== 'audio') {

Exploit Details

GitHub: Official fix commit containing automated browser unit tests (SanitizationTest.ts) with working PoC vectors for video, audio, and img elements.

Mitigation Strategies

Upgrade TinyMCE to version 7.9.4 or 8.9.3 (or later) across all frontend bundles and server-side dependencies.
Disable the TinyMCE 'media' plugin in the editor initialization configuration if immediate patching is not possible.
Implement server-side HTML sanitization to strip internal TinyMCE attributes (such as data-mce-object and data-mce-p-*) prior to storing user-supplied markup.
Deploy a strict Content Security Policy (CSP) that disallows inline script execution (removing 'unsafe-inline' from script-src) to prevent inline event handlers like onerror from executing.

Remediation Steps:

Audit project dependency manifests (package.json, composer.json, packages.config) to identify TinyMCE versions in the ranges >= 7.9.3, < 7.9.4 or >= 8.5.1, < 8.9.3.
Update the dependency version constraint to ^7.9.4 or ^8.9.3 using npm, yarn, NuGet, or Composer.
Rebuild and redeploy frontend assets if TinyMCE is bundled via Webpack, Vite, or Rollup.
Verify in browser developer tools that tinymce.majorVersion and tinymce.minorVersion reflect the patched release.
Review existing database records containing rich text for anomalous occurrences of 'data-mce-object' combined with 'data-mce-p-on' attributes.

References

Read the full report for CVE-2026-116675 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community