VDB
Sign up
HIGH8.7

GHSA-q742-qvgc-gc2f

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Quick fix

GHSA-q742-qvgc-gc2f — tinymce: upgrade to the fixed version with the command below.

npm install tinymce@7.9.3

Details

### Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.

### Patches Patched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x).

### Workarounds No official workaround available.

### Fix To avoid this vulnerability:

Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).

### Acknowledgements Tiny thanks [Tadi Kadango](https://github.com/mtrill47) ([website](https://tadiwakadango.com/)) and [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/tinymce
Introduced in: 0

No fixed version published yet for tinymce (npm). Pin to a known-safe version or switch to an alternative.

npm/tinymce
Introduced in: 6.0.0Fixed in: 7.9.3
Fixnpm install tinymce@7.9.3
npm/tinymce
Introduced in: 8.0.0Fixed in: 8.5.1
Fixnpm install tinymce@8.5.1
NuGet/TinyMCE
Introduced in: 0

No fixed version published yet for TinyMCE (nuget). Pin to a known-safe version or switch to an alternative.

NuGet/TinyMCE
Introduced in: 6.0.0Fixed in: 7.9.3
Fixdotnet add package TinyMCE --version 7.9.3
NuGet/TinyMCE
Introduced in: 8.0.0Fixed in: 8.5.1
Fixdotnet add package TinyMCE --version 8.5.1
Packagist/tinymce/tinymce
Introduced in: 0

No fixed version published yet for tinymce/tinymce (composer). Pin to a known-safe version or switch to an alternative.

Packagist/tinymce/tinymce
Introduced in: 6.0.0Fixed in: 7.9.3
Fixcomposer require tinymce/tinymce:^7.9.3
Packagist/tinymce/tinymce
Introduced in: 8.0.0Fixed in: 8.5.1
Fixcomposer require tinymce/tinymce:^8.5.1

References