Skip to main content

Changelog

42.0.0 — 2026-07-24​

Initial release of Editor42, forked from the last MIT-licensed version of TinyMCE.

Changed​

  • Forked from TinyMCE 6.8.6 as Editor42
  • Rebranded UI (statusbar logo, About dialog, Help dialog) and metadata
  • Detached from the upstream hosted cloud and paid services
  • Same API, configuration, plugins, and themes as TinyMCE

Security​

Advisory details and per-fix commits are on the Security page.

  • Upgraded DOMPurify from 3.1.7 to 3.4.7, removed the patch-package workaround
  • Defaulted convert_unsafe_embeds to true (CVE-2024-29881)
  • Defaulted sandbox_iframes to true, with exclusions (CVE-2024-29203)
  • Fixed stored XSS via mce:protected comments (CVE-2026-47762)
  • Fixed stored XSS via data-mce-prefixed attributes on input (CVE-2026-47759)
  • Fixed XSS via data-mce-object injection in the media plugin (CVE-2026-47761)
  • Fixed XSS via namespace scope confusion in nested SVG (CVE-2026-47760)