TinyMCE CVE-2026-47760: Overview of Nested SVG Sanitizer Bypass Leading to Stored XSS

Introduction

A sanitizer bypass in TinyMCE's SVG namespace handling lets authenticated users inject persistent JavaScript payloads that execute in the browser context of any user who views the crafted content. TinyMCE powers over 100 million projects and holds roughly 32% of the rich text editor market, so the blast radius of this stored XSS vulnerability is substantial.

TinyMCE is an open-source WYSIWYG rich text editor that more than 1.5 million developers use to add content editing to web applications, CMS platforms, SaaS products, and enterprise tools. Tiny Technologies, Inc. (now part of Tiugo Technologies) maintains it and distributes it via npm, NuGet, Composer, and a hosted CDN (Tiny Cloud). Because TinyMCE dominates the editor market and developers rarely switch editors once they adopt one, its vulnerabilities have outsized downstream impact.

CVE-2026-47760 carries a CVSS v3.1 base score of 8.7 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The scope change (S:C) means the XSS payload executes in the full browser context of the hosting application rather than inside the TinyMCE editor frame, with access to session tokens, cookies, and the entire DOM. maple3142 of DEVCORE, a penetration testing firm, discovered the vulnerability and disclosed it responsibly, with a coordinated patch release in TinyMCE 7.1.0.

Technical information

Root cause: SVG namespace scope tracking failure

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting"). It sits in TinyMCE's HTML sanitizer, in the logic that tracks SVG namespace scope across nested elements.

When a working sanitizer encounters an SVG element, it has to recognize that all child elements exist within the SVG namespace, where different attribute validation rules apply. SVG elements can legitimately include event handler attributes like onload that would be dangerous in an HTML context. So the sanitizer has to track which namespace is active at each nesting level and apply the matching validation rules.

In TinyMCE versions 6.8.0 through 7.0.x, multiple layers of nested <svg> elements cause the sanitizer's state machine to lose track of which namespace rules govern deeply nested child elements. The sanitizer then evaluates event handler attributes under a permissive namespace context, and attributes containing malicious JavaScript (such as onload, onmouseover, or onclick) pass through sanitization undetected.

CVSS scoring breakdown

The CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear, with E:U indicating no known active exploitation at the time of scoring.

Attack flow

An attacker exploiting CVE-2026-47760 would follow this general sequence:

1. The attacker crafts an HTML fragment with multiple layers of nested <svg> elements, where the inner elements carry JavaScript event handler attributes that the sanitizer fails to strip because of the namespace tracking failure.

2. The attacker submits the payload through any feature that stores or displays user-generated content via TinyMCE: comment fields, profile biographies, document editors, CMS content areas, or any other input that passes through the TinyMCE editor and its sanitizer.

3. TinyMCE processes the submitted content, and the sanitizer reaches the nested SVG structure. Because it has lost track of namespace scope, it treats the malicious event handler attributes on the inner SVG elements as legitimate SVG attributes rather than dangerous HTML event handlers, and they survive sanitization.

4. When a victim loads or interacts with the page containing the stored payload, the browser renders the nested SVG elements and executes the JavaScript in the event handlers. Because this is stored (persistent) XSS, every user who views the affected content is a potential victim.

5. Because of the scope change (S:C), the executed JavaScript runs in the context of the entire web application. That allows session hijacking via cookie theft, credential harvesting, DOM manipulation, unauthorized actions on the victim's behalf, and data exfiltration. The high confidentiality and high integrity ratings reflect the full range of actions available to an attacker running JavaScript in the application context.

Relationship to previous SVG namespace bypasses

This is the third documented SVG-related XSS bypass in TinyMCE. The previously disclosed CVE-2024-29881 allowed XSS through SVG embed elements with improper namespace handling. CVE-2026-47760 uses nested SVG trees rather than a single SVG element with an embed, which makes it more sophisticated and harder to detect through simple pattern matching.

The TinyMCE 7.4.1 release notes also reference a related fix involving "DOMPurify allowing some bypassing which lead to improper sanitization of invalid HTML elements within XML contexts, exploiting parsing" differences between the HTML and XML parsers. This confirms that SVG/XML namespace boundaries have been an ongoing architectural problem for the TinyMCE sanitizer.

The bypasses have grown more sophisticated, from a single-element bypass (CVE-2024-29881) to a multi-layered nested SVG bypass (CVE-2026-47760), while exploiting the same underlying weakness in namespace boundary handling. The fix in 7.1.0 rewrote the problematic code instead of applying a targeted patch, which suggests the vendor recognized that incremental fixes were not enough.

Defense-in-depth considerations

The GitHub advisory states that no workaround is available. Upgrading to TinyMCE 7.1.0 is the only remediation path. Organizations should still put supplementary controls in place:

• A strict Content Security Policy (CSP) header that restricts inline script execution (script-src without 'unsafe-inline') is a second line of defense. Even if a payload survives the TinyMCE sanitizer, CSP can prevent the injected JavaScript from executing.
• Validate content on the server. Client-side sanitization alone is insufficient, because direct HTTP requests can skip the editor entirely. Organizations should rigorously validate all content submitted through TinyMCE on the server, including rejecting or sanitizing SVG content before storage.
• Review the DOMPurify configuration. TinyMCE uses DOMPurify 3.x for HTML sanitization, and the TinyMCE documentation notes that the editor does not natively support SVGs because of security risks. Organizations should evaluate whether they genuinely need SVG support and configure DOMPurify with the most restrictive settings possible.
• Set the HttpOnly and Secure flags on session cookies. This limits the impact of a successful XSS exploit by preventing JavaScript from reading session tokens via document.cookie.

Affected systems and versions

CVE-2026-47760 affects every TinyMCE installation from version 6.8.0 up to, but not including, 7.1.0. That covers all 6.8.x, 6.9.x, and 7.0.x releases, across every distribution channel:

Organizations using Tiny Cloud (CDN-hosted TinyMCE) should check the version query parameter or the TinyMCE initialization output to confirm that their application loads 7.1.0 or later.

Critical note for TinyMCE 6.x users: TinyMCE 6 has reached end of life and will not receive security patches for this vulnerability. There is no patch path for the 6.x branch, so organizations running any TinyMCE 6.x version must upgrade to TinyMCE 7.1.0 or later. This adds to the earlier unpatched vulnerabilities in the 6.x line, including CVE-2024-29203 and CVE-2024-29881.

Vendor security history

TinyMCE has had a series of XSS vulnerabilities, many of them involving SVG handling and sanitizer bypasses:

Sanitizer bypasses keep recurring, especially ones that exploit SVG namespace handling, and that points to a systemic design problem. Each fix has addressed one bypass technique, while the underlying namespace tracking logic has kept producing new variants. The vendor maintains a responsible disclosure program and has patched consistently, but the pattern suggests that the integration layer between TinyMCE and its DOMPurify-based sanitization engine is still a persistent source of security issues.

Because TinyMCE 6 has reached end of life, organizations still running TinyMCE 6.x face compounding risk from both older and newer XSS flaws, with no vendor patch path available.

References

• NVD: CVE-2026-47760
• GitHub Advisory GHSA-mh5m-5hw4-5c69: TinyMCE XSS via Nested SVG Sanitization Bypass
• SB2026052049: Cross-site Scripting in TinyMCE
• TinyMCE Security Guide
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2024-29881
• TinyMCE Changelog
• TinyMCE 7.4.1 Release Notes
• TinyMCE Security Advisories
• TinyMCE 6 End of Life: Unpatched XSS Vulnerabilities (HeroDevs)
• DEVCORE Team
• Developer Survey Results: State of Rich Text Editors in 2023
• Snyk: tinymce Package Vulnerabilities