What is GHSA-x5j7-r8g5-qxr3?

GHSA-x5j7-r8g5-qxr3 is a security advisory published by GitHub Security Advisories with Medium severity. The platform allows persistent HTML injection into editable fields managed by TinyMCE. An...

Which CVE IDs does GHSA-x5j7-r8g5-qxr3 cover?

GHSA-x5j7-r8g5-qxr3 covers the following CVE IDs: CVE-2026-111040. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-x5j7-r8g5-qxr3Medium

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-111040 →

📋 Description

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111040
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform
https://github.com/advisories/GHSA-x5j7-r8g5-qxr3