CVE-2023-45818
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
Using tinymce by tinymce?
Get instant alerts when new vulnerabilities affect tinymce - before attackers find them.
Description
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (5)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.