CVE-2023-45818: TinyMCE mutation XSS in undo/redo and content APIs

CVE-2023-45818 · Severity: low · CVSS 3.1 · Published 2023-10-19

TinyMCE is a widely-used rich text editor embedded in web applications. A mutation cross-site scripting (mXSS) vulnerability allows attackers to bypass the editor's HTML sanitization through manipulation of undo/redo operations and related APIs. By restoring carefully-crafted HTML from the undo stack, malicious JavaScript can be executed in the context of the user's browser, potentially compromising data and sessions.

Technologies: tinymce (npm), TinyMCE (NuGet), tinymce/tinymce (Packagist). Vendors: npm, NuGet, Packagist.

Quick answers

Is CVE-2023-45818 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-45818 being exploited in the wild.
How severe is CVE-2023-45818?
Low severity, with a CVSS score of 3.1, published 19 October 2023.
Which products and versions are affected?
tinymce (npm) SEMVER:introduced=6.0.0,fixed=6.7.1; TinyMCE (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1; tinymce/tinymce (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.7.1.
Is there a fix for CVE-2023-45818?
Yes. tinymce (npm): upgrade to 6.7.1 or later; TinyMCE (NuGet): upgrade to 6.7.1 or later; tinymce/tinymce (Packagist): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-45818 attacked?
It is attacked over the network.
Am I affected by CVE-2023-45818?
Check whether you run tinymce (npm), TinyMCE (NuGet) or tinymce/tinymce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tinymce (npm): upgrade to 6.7.1 or later
    npm install tinymce@6.7.1
  • TinyMCE (NuGet): upgrade to 6.7.1 or later
    dotnet add package TinyMCE --version 6.7.1
  • tinymce/tinymce (Packagist): upgrade to 6.7.1 or later
    composer require tinymce/tinymce:^6.7.1

Technical details

This mXSS vulnerability exists in TinyMCE's undo/redo functionality, getContent API (raw format), resetContent API, and Autosave plugin. The root cause is the use of string-level HTML trimming before storing content in the undo stack. When content is restored, browser parsing (via DOMParser in TinyMCE 6 or SaxParser in TinyMCE 5) mutates the carefully-crafted HTML snippet, transforming sanitized markup into executable XSS payload. Attack requires user interaction (triggering undo/redo or using affected APIs) and network-accessible TinyMCE instance, but no authentication. The vulnerability has been patched in TinyMCE 5.10.8 and 6.7.1 by switching to node-level HTML manipulation instead of string manipulation.

Affected products

  • Tiny Technologies TinyMCE all versions before 5.10.8 and 6.0.0–6.7.0

Identifiers

  • CVE-2023-45818
  • GHSA-v65r-p3vv-jjfv

Timeline

  • 2023-10-19: disclosed
  • 2023-10-19: patched: TinyMCE 5.10.8 and 6.7.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.