VDB
Sign up
HIGH8.7

GHSA-v98h-vmpc-fpqv

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

Quick fix

GHSA-v98h-vmpc-fpqv — tinymce: upgrade to the fixed version with the command below.

npm install tinymce@7.9.3

Details

### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.

### Patches Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.

### Workarounds No official workaround available.

### Fix To avoid this vulnerability:

Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).

### Acknowledgements Tiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/tinymce
Introduced in: 0

No fixed version published yet for tinymce (npm). Pin to a known-safe version or switch to an alternative.

npm/tinymce
Introduced in: 6.0.0Fixed in: 7.9.3
Fixnpm install tinymce@7.9.3
npm/tinymce
Introduced in: 8.0.0Fixed in: 8.5.1
Fixnpm install tinymce@8.5.1
NuGet/TinyMCE
Introduced in: 0

No fixed version published yet for TinyMCE (nuget). Pin to a known-safe version or switch to an alternative.

NuGet/TinyMCE
Introduced in: 6.0.0Fixed in: 7.9.3
Fixdotnet add package TinyMCE --version 7.9.3
NuGet/TinyMCE
Introduced in: 8.0.0Fixed in: 8.5.1
Fixdotnet add package TinyMCE --version 8.5.1
Packagist/tinymce/tinymce
Introduced in: 0

No fixed version published yet for tinymce/tinymce (composer). Pin to a known-safe version or switch to an alternative.

Packagist/tinymce/tinymce
Introduced in: 6.0.0Fixed in: 7.9.3
Fixcomposer require tinymce/tinymce:^7.9.3
Packagist/tinymce/tinymce
Introduced in: 8.0.0Fixed in: 8.5.1
Fixcomposer require tinymce/tinymce:^8.5.1

References