Executive brief
TinyMCE is a popular rich-text editor component embedded in web applications and content management systems. An attacker can inject malicious JavaScript code through specially crafted clipboard content or API calls, which executes in the browser of any user editing content—potentially allowing account takeover, data theft, or malware distribution to website visitors.
Technical details
A cross-site scripting (CWE-79) vulnerability exists in the core parser and media plugin due to insufficient HTML sanitization and CDATA handling. An attacker can craft malicious content containing JavaScript and insert it via the clipboard or direct API calls. The vulnerable code fails to properly sanitize or filter CDATA sections during parsing, allowing arbitrary script execution in the context of the editor user's session. The vulnerability was patched in TinyMCE 4.9.10 and 5.2.2 through improved HTML parsing and sanitization logic. Workarounds include disabling the media plugin and manually stripping CDATA elements.
Affected products
- Tiny Technologies TinyMCE 4.9.9 and lower, 5.0.0 to 5.2.1
Timeline
- 2020-05-07: disclosed
- 2020-05-07: patched: Patched in TinyMCE 4.9.10 and 5.2.2