From 4542e650634d010fd61cbf31b3b4623d8729282b Mon Sep 17 00:00:00 2001 From: Karl Kemister-Sheppard Date: Wed, 28 Oct 2026 11:57:14 +1000 Subject: [PATCH] TINYDOC-3690: Add the CVE-2026-116675 link to the TinyMCE 7.9.4 release notes. --- modules/ROOT/pages/7.9.4-release-notes.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/7.9.4-release-notes.adoc b/modules/ROOT/pages/7.9.4-release-notes.adoc index 01c8593278..1eda154d14 100644 --- a/modules/ROOT/pages/7.9.4-release-notes.adoc +++ b/modules/ROOT/pages/7.9.4-release-notes.adoc @@ -26,7 +26,7 @@ include::partial$misc/admon-releasenotes-for-stable.adoc[] A stored cross-site scripting (XSS) vulnerability was identified in the media plugin. Elements crafted through the `data-mce-object` attribute were created before sanitization, which allowed event handler scripts on those elements to run. {productname} {release-version} ensures that, when the media plugin is in use, any content created through the `data-mce-object` attribute is sanitized first. -CVE: _pending_ +CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-116675[CVE-2026-116675] GHSA: https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm[GitHub Advisories].