Executive brief
TinyMCE is a popular rich-text editor component used in web applications and content management systems. A mutation cross-site scripting (mXSS) vulnerability allows attackers to craft malicious content that bypasses initial sanitization checks and executes arbitrary JavaScript when the editor's undo/redo function or certain APIs process the content. This can lead to theft of user data, session hijacking, or malware injection in affected web applications.
Technical details
The vulnerability is a mutation cross-site scripting (mXSS) issue in TinyMCE's serialization and parsing logic. Text nodes within specific parent elements are not properly escaped according to HTML standards. When such text nodes contain a special internal marker character, they can be combined with other HTML patterns to create malicious payloads that pass initial sanitization but trigger XSS when the marker is removed and content is re-parsed. The vulnerability affects the core undo/redo functionality and specific APIs (getContent, resetContent) as well as the Autosave plugin. It requires user interaction to trigger (typically editing and saving content) but no authentication. The vulnerability has been patched in TinyMCE 6.7.3 and 5.10.9.
Affected products
- Tiny Technologies TinyMCE Before 5.10.9, 6.0.0 before 6.7.3
Timeline
- 2023-11-15: disclosed
- 2023-11-15: patched: TinyMCE 5.10.9 and 6.7.3 released