TinyMCE filters out some of the more common XSS content like scripts etc. from the contents since it's relatively common that the editor is used in a single page application. However, if you want extra security, then we suggest passing it through server-side filters like HTMLPurifier.
script-src 'self' *.tinymce.com; Scripts are sometimes loaded as script element with an src attribute.
connect-src 'self' *.tinymce.com; XMLHttpRequest are required by some services such as spellchecking.
img-src 'self' *.tinymce.com data: blob:; Images within the editor are sometimes base64 encoded or blob URLs or proxied through the cloud service.
style-src 'self' 'unsafe-inline'; Styles are used on dialogs/menus to position them relative to other elements.
font-src 'self' *.tinymce.com; Fonts are used for icons in the UI and is loaded from external files.