Executive brief
TinyMCE is a popular rich-text editor component used in web applications and content management systems. An attacker can exploit an XSS vulnerability in the notification manager to execute arbitrary JavaScript code in a user's browser session, potentially leading to account compromise, data theft, or unauthorized actions performed on behalf of the user.
Technical details
A cross-site scripting (XSS) vulnerability exists in TinyMCE's Notification Manager API (notificationManager.open) due to unfiltered HTML rendering in notification messages. The vulnerability is triggered when malicious content is inserted into the editor and a notification is subsequently displayed; the text parameter's HTML is rendered without sanitization, allowing arbitrary JavaScript execution in the user's browser context. Attack requires user interaction (triggering a notification) and network access to a TinyMCE-enabled application, but no authentication or special privileges. The vulnerability affects TinyMCE versions prior to 5.10.8 and 6.7.1. Patches are available and have been released to both major version branches.
Affected products
- Tiny Technologies TinyMCE < 5.10.8, >= 6.0.0 and < 6.7.1
Timeline
- 2023-10-19: disclosed: Advisory GHSA-hgqx-r2hp-jr38 published
- 2023-10-19: patched: TinyMCE 5.10.8 and 6.7.1 released with patches