Executive brief
TinyMCE is a popular rich-text editor embedded in web applications and content management systems. A cross-site scripting (XSS) vulnerability in its image and link plugins allowed attackers to inject malicious JavaScript code when crafting specially-formed URLs. While the dangerous URLs were stripped from saved content, the vulnerability exposed users during the editing session, potentially allowing attackers to steal session tokens, modify content, or perform actions on behalf of the editor.
Technical details
The vulnerability is a reflected/stored cross-site scripting (CWE-79) flaw in the URL processing logic of TinyMCE's image and link plugins. When a user updates an image or link element using a specially-crafted URL containing JavaScript payloads, the plugins fail to properly sanitize the input before rendering it in the editor interface. The attack requires user interaction (a user must attempt to edit an image or link with a malicious URL), and affects all versions prior to 5.10.0. The fix, released in TinyMCE 5.10.0, improved sanitization logic when processing and displaying URLs in these plugins. Note: dangerous URLs are stripped from content saved to the database, limiting persistence.
Affected products
- Tiny Technologies TinyMCE < 5.10.0
- jazzband django-tinymce < 3.4.0
Timeline
- 2021-11-02: disclosed: Advisory published
- 2021-11-01: patched: Fix released in TinyMCE 5.10.0