GHSA-h96f-fc7c-9r55
Regex denial of service vulnerability in codesample plugin
GHSA-h96f-fc7c-9r55 is a vulnerability with no CVSS score yet in tinymce, published January 6, 2021. No source lists public exploit code. Fixed in tinymce 5.6.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.6.0tinymce
Description
Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or lower.
Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.
Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the
codesampleplugin - Disable ruby code samples using the codesample_languages setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the codesample_global_prismjs setting
Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.
References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes
For more information
If you have any questions or comments about this advisory:
- Open an issue in the TinyMCE repo
- Email us at infosec@tiny.cloud
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tinymcenpm | before 5.6.0 | 5.6.0 |
What each source reports
GitHub AdvisoriesNo score
Regex denial of service vulnerability in codesample plugin
Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or lower.
Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.
Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the
codesampleplugin - Disable ruby code samples using the codesample_languages setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the codesample_global_prismjs setting
Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.
References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes
For more information
If you have any questions or comments about this advisory:
- Open an issue in the TinyMCE repo
- Email us at infosec@tiny.cloud
- Record
GHSA-h96f-fc7c-9r55- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVNo score
Regex denial of service vulnerability in codesample plugin
Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the codesample plugin using TinyMCE 5.5.1 or lower.
Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.
Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the
codesampleplugin - Disable ruby code samples using the codesample_languages setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the codesample_global_prismjs setting
Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.
References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes
For more information
If you have any questions or comments about this advisory:
- Open an issue in the TinyMCE repo
- Email us at infosec@tiny.cloud
- Record
GHSA-h96f-fc7c-9r55- Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.