Executive brief
TinyMCE is a popular open-source rich text editor used in web applications to allow users to create and edit formatted content. A cross-site scripting vulnerability in the image and link plugins allows attackers to execute arbitrary JavaScript code in the browsers of users who are actively editing content, potentially compromising session data or performing actions on behalf of the user. While the dangerous URLs are stripped from any final content extracted from the editor, the vulnerability poses a risk during the editing process itself.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the URL processing logic of TinyMCE's image and link plugins. An attacker can craft special URLs that bypass sanitization when an editing user updates an image or link within the editor, allowing arbitrary JavaScript execution in the user's browser context. The attack requires network access and user interaction (the user must be actively editing and must update an image or link with the malicious URL). The vulnerability was patched in TinyMCE 5.10.0 through improved sanitization logic in URL handling. Affected versions include all 5.9.2 and earlier releases.
Affected products
- TinyMCE TinyMCE < 5.10.0
Timeline
- 2021-11-01: disclosed
- 2021-11-01: patched: TinyMCE 5.10.0 released with fix
- 2024-01-03: advisory: GHSA-wxj2-777f-vxmf published (duplicate of GHSA-r8hm-w5f7-wj39)