Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 6 May 2021.

Which products and versions are affected?

tinymce (npm) SEMVER:introduced=0,fixed=4.9.7.

Is there a fix for This vulnerability?

Yes. tinymce (npm): upgrade to 4.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

TinyMCE cross-site scripting in parser and plugins

Severity: low · CVSS 3.1 · Published 2021-05-06

TinyMCE is a widely-used rich text editor component embedded in web applications and content management systems. A cross-site scripting (XSS) vulnerability in the parser and paste/visualchars plugins allows attackers to execute arbitrary JavaScript in users' browsers when specially crafted content is inserted via clipboard or API calls, potentially compromising user sessions and sensitive data.

Technologies: tinymce (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 6 May 2021.
Which products and versions are affected?: tinymce (npm) SEMVER:introduced=0,fixed=4.9.7.
Is there a fix for This vulnerability?: Yes. tinymce (npm): upgrade to 4.9.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tinymce (npm): upgrade to 4.9.7 or later
```
npm install tinymce@4.9.7
```

Technical details

This XSS vulnerability exists in TinyMCE's core parser and the paste and visualchars plugins, stemming from insufficient HTML sanitization. An attacker can inject malicious JavaScript by crafting specially formatted content and inserting it into the editor via the clipboard or programmatic APIs—no user interaction beyond normal editor use is required. The vulnerability affects TinyMCE versions before 4.9.7 and 5.0.0 through 5.1.3. Patches were released in versions 4.9.7 and 5.1.4, which implement improved parser logic and HTML sanitization. Affected applications include any web application or CMS using vulnerable TinyMCE versions to allow user-editable rich text content.

Affected products

Tiny Technologies TinyMCE before 4.9.7 and 5.0.0 through 5.1.3

Timeline

2020-01-29: disclosed: Security advisory GHSA-27gm-ghr9-4v95 published
2020-01-29: patched: Patches released in versions 4.9.7 and 5.1.4
2023-06-27: other: Duplicate advisory GHSA-p7j5-4mwm-hv86 withdrawn

References

https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.