GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | tinymce | <= 5.10.9 | no fix listed |
| npm | tinymce | >= 6.0.0, < 7.9.3 | 7.9.3 |
| npm | tinymce | >= 8.0.0, < 8.5.1 | 8.5.1 |
| NuGet | TinyMCE | <= 5.10.9 | no fix listed |
| NuGet | TinyMCE | >= 6.0.0, < 7.9.3 | 7.9.3 |
| NuGet | TinyMCE | >= 8.0.0, < 8.5.1 | 8.5.1 |
| Packagist | tinymce/tinymce | <= 5.10.9 | no fix listed |
| Packagist | tinymce/tinymce | >= 6.0.0, < 7.9.3 | 7.9.3 |
| Packagist | tinymce/tinymce | >= 8.0.0, < 8.5.1 | 8.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.
### Patches
Patched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x).
### Workarounds
No official workaround available.
### Fix
To avoid this vulnerability:
Upgrade to TinyMCE 8.5.1 or higher.
Upgrade to TinyMCE 7.9.3 or higher.
Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).
### Acknowledgements
Tiny thanks [Tadi Kadango](https://github.com/mtrill47) ([website](https://tadiwakadango.com/)) and [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.
References
External links from the advisory. They lead to third-party sites.