Executive brief
TinyMCE is a popular rich text editor used in web applications to allow users to create and edit formatted content. A cross-site scripting (XSS) vulnerability in its URL sanitization logic allows attackers to inject arbitrary JavaScript code when malicious content is pasted or inserted via APIs, potentially leading to account compromise, data theft, or malware distribution affecting all users with editor access.
Technical details
A cross-site scripting vulnerability exists in the URL sanitization logic of TinyMCE's core parser (CWE-79). The vulnerability is triggered when specially crafted content is inserted into the editor via clipboard operations or programmatic APIs. The root cause is insufficient sanitization of URL attributes in iframe, object, and embed elements. An attacker with the ability to provide content to the editor—such as through a compromised paste operation or direct API call—can inject JavaScript that executes in the context of the editor's host page. The vulnerability has been patched in version 5.6.0 with improved URL sanitization; versions 5.5.1 and earlier are affected.
Affected products
- Tiny Technologies TinyMCE all versions before 5.6.0
Timeline
- 2021-01-06: disclosed: Vulnerability published on GitHub Advisory Database
- 2021-01-06: patched: Patched in TinyMCE 5.6.0