CVE-2023-48219

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8Vendor Advisory
• https://tiny.cloud/docs/release-notes/release-notes5109/Release Notes
• https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes/Release Notes
• https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8Vendor Advisory
• https://tiny.cloud/docs/release-notes/release-notes5109/Release Notes
• https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes/Release Notes

Published

Nov 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48206A Cross Site Scripting (XSS) vulnerability in GaatiTrack Cou…6.1
• CVE-2023-48207Availability Booking Calendar 5.0 allows CSV injection via t…8.8
• CVE-2023-48208A Cross Site Scripting vulnerability in Availability Booking…6.1
• CVE-2023-4821The Drag and Drop Multiple File Upload for WooCommerce WordP…5.4
• CVE-2023-48217Statamic is a flat-first, Laravel + Git powered CMS designed…8.8
• CVE-2023-48218The Strapi Protected Populate Plugin protects `get` endpoint…5.3
• CVE-2023-4822Grafana is an open-source platform for monitoring and observ…7.2
• CVE-2023-48220Decidim is a participatory democracy framework. Starting in …7.4
• CVE-2023-48221wire-avs provides Audio, Visual, and Signaling (AVS) functio…8.8
• CVE-2023-48222Rundeck is an open source automation service with a web cons…5.4
• CVE-2023-48223fast-jwt provides fast JSON Web Token (JWT) implementation. …5.9
• CVE-2023-48224Fides is an open-source privacy engineering platform for man…9.1