Executive brief
TinyMCE is a widely-used JavaScript rich-text editor embedded in web applications. A vulnerability in its schema validation logic allows an attacker to insert malicious HTML via the editor clipboard or APIs, which executes as JavaScript in other users' browsers. If server-side sanitization is not in place, published content could carry malicious scripts.
Technical details
A cross-site scripting (XSS) vulnerability exists in TinyMCE's core parser schema validation logic (CWE-79). An unauthenticated remote attacker can craft HTML content and insert it via the clipboard or editor APIs; the parser fails to properly validate this content after unwrapping invalid elements, allowing arbitrary JavaScript execution. User interaction is required (inserting the malicious content into the editor). The vulnerability affects TinyMCE versions before 5.9.0 and is patched in 5.9.0 by ensuring schema validation occurs after element unwrapping. Workarounds include manual content sanitization via the BeforeSetContent event.
Affected products
- Tiny Technologies TinyMCE before 5.9.0
Timeline
- 2021-10-21: disclosed: Published as GHSA-5h9g-x5rv-25wg; GHSA-gjhc-6xm7-mc8q is a duplicate advisory published 2024-01-03
- 2021-10-21: patched: Version 5.9.0 released with patch