Executive brief
TinyMCE is a widely-used rich-text editor component embedded in web applications. A regular expression denial of service (ReDoS) vulnerability in the codesample plugin can cause the browser to freeze when a user attempts to highlight poorly-formed Ruby code samples. An attacker could exploit this by crafting malicious Ruby code in a document to render the editor unresponsive and degrade user experience.
Technical details
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin, specifically in the syntax highlighter used for Ruby code samples. The vulnerability resides in the regex pattern matching logic used during syntax highlighting. Attack vector is local (user-initiated) with no authentication required—simply viewing or attempting to edit a document containing malformed Ruby code triggers the ReDoS condition. An attacker can craft poorly-formed Ruby code that causes the regex engine to perform excessive backtracking, freezing the browser and rendering the editor unusable. The vulnerability affects TinyMCE versions prior to 5.6.0 and was fixed in version 5.6.0 by upgrading the underlying syntax highlighting dependency. Workarounds include disabling the codesample plugin or upgrading to PrismJS 1.21.0 or higher.
Affected products
- Tiny Technologies TinyMCE < 5.6.0
Timeline
- 2021-01-06: disclosed