GHSA-jxcx-3h54-qqxx
SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE
Quick fix
GHSA-jxcx-3h54-qqxx — silverstripe/admin: upgrade to the fixed version with the command below.
composer require silverstripe/admin:^1.13.6Details
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.
Are you affected?
Enter the version of the package you're using.
Affected packages
1.0.0Fixed in: 1.13.6composer require silverstripe/admin:^1.13.6