Executive brief
TinyMCE is a popular rich-text editor embedded in web applications and content management systems. A cross-site scripting (XSS) flaw in its URL sanitization logic allows attackers to inject malicious JavaScript code through specially crafted content, which executes in the browsers of other users viewing that content. This can lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in the URL sanitization logic of TinyMCE's core parser, affecting versions before 5.6.0. An unauthenticated attacker can insert crafted HTML (via clipboard, APIs, or other content insertion mechanisms) containing malicious JavaScript in iframe, object, or embed element URL attributes. The crafted content persists in the editor and executes arbitrary JavaScript in the context of other users' browsers when they view or edit the content. The vulnerability was patched in version 5.6.0 through improved URL sanitization logic. Workarounds include using node filters to sanitize specific attributes or disabling problematic elements entirely via the invalid_elements configuration.
Affected products
- Tiny Technologies TinyMCE < 5.6.0
Timeline
- 2021-01-06: disclosed
- 2021-01-06: patched: Version 5.6.0 released with patch
- 2024-01-03: advisory: Advisory republished as GHSA-q5pp-5q2h-g8rv (duplicate of GHSA-w7jx-j77m-wp65)