GitHub Advisoryadvisory · Packagist, npm, NuGet

GHSA-5359-pvf2-pw78 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

MEDIUM Published 2024-03-26 Modified 2024-03-26 Official page ↗
Aliases
CVE-2024-29881
Ecosystem
Packagist, npm, NuGet
Packages
tinymce/tinymce, tinymce, TinyMCE
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-03-26

Affected packages

• Packagist tinymce/tinymce: < 7.0.0 → fixed in 7.0.0 • npm tinymce: < 7.0.0 → fixed in 7.0.0 • NuGet TinyMCE: < 7.0.0 → fixed in 7.0.0

Description

Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an `object` or `embed` element and that image could potentially contain a XSS payload. Fix TinyMCE 6.8.1 introduced a new `convert_unsafe_embeds` option to automatically convert `object` and `embed` elements respective of their `type` attribute. From TinyMCE 7.0.0 onwards, the `convert_unsafe_embeds` option is enabled by default. Workarounds If you are using TinyMCE 6.8.1 or higher, set `convert_unsafe_embeds` to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any `object` or `embed` elements. This can be added using the `editor.parser.addNodeFilter` and `editor.serializer.addNodeFilter` APIs. Acknowledgements Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. References • TinyMCE 6.8.1 • TinyMCE 7.0.0

Related

Alias · CVE (1)

  • CVE-2024-29881 TinyMCE is an open source rich text editor. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References