Dependency scanning
Check whether tinymce is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
CVE-2024-21911
Cross-site scripting vulnerability in TinyMCE
CVE-2024-21908
Cross-site scripting vulnerability in TinyMCE
CVE-2020-17480
Cross-site scripting vulnerability in TinyMCE
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
GHSA-q5pp-5q2h-g8rv
Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE
GHSA-gjhc-6xm7-mc8q
Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE
GHSA-wxj2-777f-vxmf
Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE plugins
CVE-2022-23494
Cross-site scripting vulnerability in TinyMCE alerts
CVE-2020-12648
Cross-site scripting vulnerability in TinyMCE
CVE-2019-1010091
XSS in TinyMCE
GHSA-p7j5-4mwm-hv86
Duplicate Advisory: Cross-site scripting in TinyMCE
GHSA-5vm8-hhgr-jcjp
Cross-site scripting vulnerability in TinyMCE
GHSA-h96f-fc7c-9r55
Regex denial of service vulnerability in codesample plugin
Browse more npm advisories
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes