Start for Free
UNKNOWN npm

XSS in TinyMCE

GHSA-c78w-2gw7-gjv3 · CVE-2019-1010091

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

A cross-site scripting (XSS) vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

Patches

This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

Workarounds

The workarounds available are:

  • disable the media plugin and manually sanitize CDATA content (see below)
    or
  • upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

Example: Manually strip CDATA elements

setup: function(editor) {
  editor.on('PreInit', function() {
    editor.parser.addNodeFilter('#cdata', function(nodes) {
      for (var i = 0; i < nodes.length; i++) {
        nodes[i].remove();
      }
    });
  });
}

Acknowledgements

Tiny Technologies would like to thank Michał Bentkowski and intivesec for discovering these vulnerabilities.

References

https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

For more information

If you have any questions or comments about this advisory:

References

More npm vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes