Executive brief
TinyMCE is a rich-text editor widely used in web applications and content management systems. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code via specially crafted noscript elements that are executed when content is loaded into the editor, potentially compromising user data and sessions.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in TinyMCE's content parsing code. The root cause is improper handling of noscript HTML elements during content parsing, which allows malicious code embedded within noscript tags to be executed when that content is loaded into the editor. The attack requires user interaction (loading the malicious content into the editor) and network-level access, but no authentication or special privileges. An attacker can exploit this to execute arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, credential theft, or data exfiltration. The vulnerability has been patched in TinyMCE 5.11.0 LTS, 6.8.4, and 7.2.0.
Affected products
- Tiny TinyMCE before 5.11.0, 6.0.0 before 6.8.4, 7.0.0 before 7.2.0
Timeline
- 2024-06-19: disclosed: Vulnerability published as GHSA-w9jx-4g6g-rp7x
- 2024-06-19: patched: Patches released: TinyMCE 5.11.0 LTS, 6.8.4, and 7.2.0