Executive brief
TinyMCE is a widely used rich-text editor library integrated into many web applications to allow users to create and format content. A security flaw was found where the editor fails to properly clean content when it is pasted from the clipboard or inserted via automated tools. This could allow an attacker to execute malicious scripts in the browser of another user, potentially leading to unauthorized actions or data theft within the affected application.
Technical details
A cross-site scripting (XSS) vulnerability exists in TinyMCE's core parser, as well as the 'paste' and 'visualchars' plugins. The issue stems from improper HTML sanitization and logic errors in how the editor handles HTML-like text and comments during content insertion. An attacker can exploit this by crafting malicious content that, when pasted into the editor or inserted via APIs, executes arbitrary JavaScript in the context of the user's session. The vulnerability is resolved in versions 4.9.7 and 5.1.4 through improved parser logic and enhanced sanitization routines.
Affected products
- Tiny Technologies TinyMCE < 4.9.7, >= 5.0.0 < 5.1.4
Timeline
- 2019-12-18: patched: TinyMCE 5.1.4 released with security fixes.
- 2020-01-29: advisory: GitHub security advisory published.
- 2020-08-10: disclosed: NVD published the CVE record.