Update TinyMCE?

[NiklasBr]

Current bundled version of TinyMCE seems to be 6.7.0 (released Aug 2023) is subject to a few disclosed security issues.

The latest version on 6.7.x is 6.7.3 (released Nov 2023).

The latest version on 6.x is 6.8.6 – between the bundled and that version a lot of bug and security fixes have been incorporated. Are there any plans to update?

[brusch]

To be honest, this is currently not on our top-prio list.
But we'd of course accept a PR for that and merge it within a reasonable time.

[NiklasBr]

That's okay, but you should file a security advisory to let customers know.

[brusch]

Just created a PR explaining the situation in the readme.
Creating a Pimcore CVE is not possible since you can't get another CVE for the same vulnerability, but I think this notice should be clear also in future.

Thanks for pointing out. 👍

[jdreesen]

The message in #9 seems to be inaccurate, though.

TinyMCE 6.x (...) doesn't receive any furter (security) updates (end-of-life).

If the version used in the bundle is 6.7.0 but there is a 6.8.6 version (with security fixes), it means that there are updates (even if it is EOL)!

[NiklasBr]

@brusch I don't fully agree that this issue should remain closed. See @jdreesen's comment for example.

[brusch]

@NiklasBr there will be an updated TinyMCE bundle including the latest licensed Tiny version (via Composer) soon, it's planned for 2025.3 for EE customers.

[NiklasBr]

What is the reason this bundle will not have the latest TinyMCE 6.x version?

Edit: to clarify, in the 3rd-party-licenses.md document TinyMCE version 6.7 is referenced to have the MIT license, and that was on April 30, 2025:

tinymce-bundle/3rd-party-licenses.md

Lines 11 to 13 in e187047

	### TinyMCE
	License: MIT
	https://github.com/tinymce/tinymce/blob/release/6.7/LICENSE.TXT

By then that version was already clearly outdated, TinyMCE version 6.8.5 was released on October 10, 2024 (since then 6.8.6 has also been released), this means Pimcore made a decision to not use the latest version with security fixes for this bundle. But why? It's probably not a license issue since MIT is still the license used?