Executive brief
TinyMCE is a widely-used rich text editor component embedded in web applications and content management systems. A cross-site scripting (XSS) vulnerability in the parser and paste/visualchars plugins allows attackers to execute arbitrary JavaScript in users' browsers when specially crafted content is inserted via clipboard or API calls, potentially compromising user sessions and sensitive data.
Technical details
This XSS vulnerability exists in TinyMCE's core parser and the paste and visualchars plugins, stemming from insufficient HTML sanitization. An attacker can inject malicious JavaScript by crafting specially formatted content and inserting it into the editor via the clipboard or programmatic APIs—no user interaction beyond normal editor use is required. The vulnerability affects TinyMCE versions before 4.9.7 and 5.0.0 through 5.1.3. Patches were released in versions 4.9.7 and 5.1.4, which implement improved parser logic and HTML sanitization. Affected applications include any web application or CMS using vulnerable TinyMCE versions to allow user-editable rich text content.
Affected products
- Tiny Technologies TinyMCE before 4.9.7 and 5.0.0 through 5.1.3
Timeline
- 2020-01-29: disclosed: Security advisory GHSA-27gm-ghr9-4v95 published
- 2020-01-29: patched: Patches released in versions 4.9.7 and 5.1.4
- 2023-06-27: other: Duplicate advisory GHSA-p7j5-4mwm-hv86 withdrawn