Security
Security is the reason Editor42 exists. The open-source TinyMCE 6 line reached end of life with known, publicly documented vulnerabilities left in place and no upstream fixes coming. Editor42's founding commitment is to keep that editor — under its permissive MIT license — on a secure baseline. This page is the canonical record of that work: every vulnerability fixed in each Editor42 release, and how to reach us privately when you find something new.
Every security fix ships in its own commit with regression tests, is listed in the changelog, and is added to the table below. How those commits can be read and verified against the TinyMCE source is described in Auditing Editor42.
Fixed vulnerabilities
As of the latest release, all known CVEs and security-related bugs are fixed: there are no publicly known vulnerabilities affecting Editor42 that remain unfixed. We keep watch on newly disclosed vulnerabilities and ship fixes release after release.
Fixed in Editor42 42.0.0
The first release closes the six publicly documented CVEs that were left open in the last MIT-licensed TinyMCE, plus a security upgrade of the bundled DOMPurify sanitizer. Two of the CVE fixes are cherry-picked from upstream's MIT-licensed patches; the other four are original fixes written by the Editor42 team. Each fix is its own commit in editor42com/editor42, so it can be read and verified on its own:
| Advisory | Security fix | Commit |
|---|---|---|
| — | Upgraded DOMPurify from 3.1.7 to 3.4.7, removed the patch-package workaround. | 98e985b |
| CVE-2024-29881 | Default convert_unsafe_embeds to true. Cherry-picked from upstream's MIT-licensed patch 70a5a95fce (2024-02-09). | 76e272b |
| CVE-2024-29203 | Default sandbox_iframes to true, add exclusions. Cherry-picked from upstream's MIT-licensed patch 94acea35f3 (2024-02-26). | 6795474 |
| CVE-2026-47762 | Fixed stored XSS via mce:protected comments. Original fix by the Editor42 team. | 4e77fb1 |
| CVE-2026-47759 | Fixed stored XSS via data-mce-prefixed attributes on input. Original fix by the Editor42 team. | dc6c7b2 |
| CVE-2026-47761 | Fixed XSS via data-mce-object injection in the media plugin. Original fix by the Editor42 team. | 4892c95 |
| CVE-2026-47760 | Fixed XSS via namespace scope confusion in nested SVG content. Original fix by the Editor42 team. | c38d405 |
data-mce-…, mce:protected); in the rebranded editor42 build the same internals carry the editor42 names — see Technical Details & Compatibility. Both the editor42 and main builds contain every fix.
Reporting a vulnerability
If you believe you have found a security issue in Editor42 — in any build or branch of the editor, in this website, or in our documentation examples — please report it to us privately:
Email infosec@editor42.com. Please do not open a public GitHub issue or disclose the problem publicly before we have had a chance to fix it.
A useful report ideally includes:
- the Editor42 version and build (
editor42ormain) you tested; - a minimal reproduction — the editor configuration plus the content or steps that trigger the issue;
- what an attacker gains (the impact as you understand it);
- how you would like to be credited, if at all.
What you can expect from us:
- we read every report and reply as quickly as we can;
- if the issue is confirmed, we work on a fix — shipped as its own commit with regression tests, listed in the changelog and on this page;
- credit for the find, unless you prefer to stay anonymous.
We ask that you give us a reasonable amount of time to investigate and release a fix before any public disclosure. We do not currently run a paid bug-bounty program.
This contact is also published in machine-readable form at editor42.com/.well-known/security.txt (RFC 9116).
For ordinary, non-security bugs, please use the public GitHub issue tracker instead.
For general, non-security questions — licensing, using Editor42 in your product, or anything else — email hello@editor42.com. Please keep infosec@editor42.com for security reports only, so the two don't get mixed up.