HeroDevs

NES for TinyMCE Release Notes

Comprehensive release notes and changelog for NES for TinyMCE, including security patches, bug fixes, and feature updates across all supported versions.

7 Patched Vulnerabilities
VEX Statements

v6.8.10 - July 20, 2026

Notes

  • This release updates the bundled DOMPurify dependency to remediate a reported vulnerability.
  • Full package name(s) and version(s):
    • @neverendingsupport/tinymce@6.8.6-tinymce-6.8.10

Dependency Updates

  • Upgrade dompurify to v3.4.12.

v6.8.9 - July 2, 2026

Notes

  • This release backports four security fixes and updates two dependencies to remediate vulnerabilities.
  • Full package name(s) and version(s):
    • @neverendingsupport/tinymce@6.8.6-tinymce-6.8.9

Dependency Updates

  • Upgrade dompurify to v3.4.11.
  • Upgrade prismjs to v1.30.0.

Security Fixes

  • data-mce-* attribute handling: malicious data-mce-src, data-mce-href, and data-mce-style attributes supplied in input are now nulled during parsing.
    • This fixes a high-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-47759).
  • SVG namespace tracking: nested <svg> elements no longer corrupt the sanitizer's namespace scope.
    • This fixes a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-47760).
  • media plugin serialization: media placeholder attributes (data-mce-object and data-mce-p-*) are now sanitized when reconstructing live media elements.
    • This fixes a high-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-47761).
  • Protected-comment restoration: <!--mce:protected ...--> comments are now decoded only when the protect option is configured and the decoded content fully matches a configured protect pattern.
    • This fixes a high-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-47762).

v6.8.8 - August 26, 2025

Notes

  • This release contains no functional change from the OSS tinymce v6.8.6.
  • This release mainlines OSS v6.8.6 into NES v6.8.8.
  • Full package name(s) and version(s):
    • @neverendingsupport/tinymce@6.8.6-tinymce-6.8.8

v6.8.7 - June 13, 2025

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/tinymce@6.8.5-tinymce-6.8.7g

Security Fixes

  • convert_unsafe_embeds editor option: now defaulted to true.
    • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2024-29881).
  • sandbox_iframes editor option: now defaulted to true.
    • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2024-29203).
  • sandbox_iframes_exclusions option: new option holding a list of URL host names to be excluded from iframe sandboxing when sandbox_iframes is set to true.
    • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2024-29203).

v6.8.6 - June 12, 2025

Notes

  • This release contains no functional change from the OSS tinymce v6.8.5.
  • This release mainlines OSS v6.8.5 into NES v6.8.6.
  • Full package name(s) and version(s):
    • @neverendingsupport/tinymce@6.8.5-tinymce-6.8.6