Reflected cross-site scripting (XSS) In tinymce
Description
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Impact
TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript.
Patches
This issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later.
Workarounds
No official workaround available.
Acknowledgements
Tiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability.
References
Fix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 nuget | 7.1.0 | ||
 packagist | 7.1.0 | ||
 npm | 7.1.0 |
Aliases
References