{"id":"CVE-2020-12648","aliases":["EUVD-2020-0644","GHSA-vrv8-v4w8-f95h","UBUNTU-CVE-2020-12648"],"status":"published","title":"Cross-site scripting vulnerability in TinyMCE","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01803,"percentile":0.78715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-08-11T14:55:01Z","modified":"2026-10-24T10:30:52Z","fixes":[{"ecosystem":"npm","package":"tinymce","fixed_in":["4.9.11","5.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.11"}]}]},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-2"]}],"products":[{"vendor":"tiny","product":"tinymce"}],"references":[{"url":"https://labs.bishopfox.com/advisories/tinymce-version-5.2.1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vrv8-v4w8-f95h","tags":["web"]},{"url":"https://github.com/tinymce/tinymce/pull/5843","tags":["web"]},{"url":"https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63","tags":["web"]},{"url":"https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b","tags":["web"]},{"url":"https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vrv8-v4w8-f95h"},{"url":"https://github.com/tinymce/tinymce","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-12648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12648","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-12648","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","status":"published","published":"2020-08-14T13:52:29Z","modified":"2024-08-04T12:04:22.848Z","updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-0644","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","status":"published","published":"2020-08-14T13:52:29Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.896975Z"}],"ghsa":[{"id":"GHSA-vrv8-v4w8-f95h","title":"Cross-site scripting vulnerability in TinyMCE","description":"### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.\n\n### Workarounds\nThe workarounds available are:\n- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1\nor\n- enable the media plugin, which overrides the default parsing behaviour for iframes\nor\n- add the following workaround to update the parsing schema rules for iframes:\n\n#### Example: Change the default schema for iframes\n```js\nsetup: function(editor) {\n  editor.on('PreInit', function() {\n    editor.schema.getSpecialElements()['iframe'] = /\u003c/iframe[^\u003e]*\u003e/gi;\n  });\n}\n```\n\n### Acknowledgements\nTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","status":"published","published":"2020-08-11T14:55:01Z","modified":"2023-05-22T14:51:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2020-12648","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","status":"published","published":"2020-08-14T14:15:12.41Z","modified":"2026-06-17T02:52:04.203Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:13.05572Z"}],"osv":[{"id":"CVE-2020-12648","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","status":"published","published":"2020-08-14T14:15:12.41Z","modified":"2026-10-24T10:30:52.705268956Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"GHSA-vrv8-v4w8-f95h","title":"Cross-site scripting vulnerability in TinyMCE","description":"### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.\n\n### Workarounds\nThe workarounds available are:\n- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1\nor\n- enable the media plugin, which overrides the default parsing behaviour for iframes\nor\n- add the following workaround to update the parsing schema rules for iframes:\n\n#### Example: Change the default schema for iframes\n```js\nsetup: function(editor) {\n  editor.on('PreInit', function() {\n    editor.schema.getSpecialElements()['iframe'] = /\u003c/iframe[^\u003e]*\u003e/gi;\n  });\n}\n```\n\n### Acknowledgements\nTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)","status":"published","published":"2020-08-11T14:55:01Z","modified":"2023-11-08T04:02:10.978052Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"UBUNTU-CVE-2020-12648","description":"A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.","status":"published","published":"2020-08-14T14:15:00Z","modified":"2025-10-24T04:48:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"}]}}