TinyMCE cross-site scripting in image and link plugins

Severity: info · CVSS 6.1 · Published 2024-01-03

TinyMCE is a popular open-source rich text editor used in web applications to allow users to create and edit formatted content. A cross-site scripting vulnerability in the image and link plugins allows attackers to execute arbitrary JavaScript code in the browsers of users who are actively editing content, potentially compromising session data or performing actions on behalf of the user. While the dangerous URLs are stripped from any final content extracted from the editor, the vulnerability poses a risk during the editing process itself.

Technologies: tinymce (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, with a CVSS score of 6.1, published 3 January 2024.
Which products and versions are affected?
tinymce (npm) SEMVER:introduced=0.
Is there a fix for This vulnerability?
A patch was published on 2021-11-01: TinyMCE 5.10.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the URL processing logic of TinyMCE's image and link plugins. An attacker can craft special URLs that bypass sanitization when an editing user updates an image or link within the editor, allowing arbitrary JavaScript execution in the user's browser context. The attack requires network access and user interaction (the user must be actively editing and must update an image or link with the malicious URL). The vulnerability was patched in TinyMCE 5.10.0 through improved sanitization logic in URL handling. Affected versions include all 5.9.2 and earlier releases.

Affected products

  • TinyMCE TinyMCE < 5.10.0

Timeline

  • 2021-11-01: disclosed
  • 2021-11-01: patched: TinyMCE 5.10.0 released with fix
  • 2024-01-03: advisory: GHSA-wxj2-777f-vxmf published (duplicate of GHSA-r8hm-w5f7-wj39)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.