TinyMCE Cross-Site Scripting (XSS) Vulnerability in Handling External SVG Files
Summary
CVE-2024-29881: Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. Affects tinymce/tinymce versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for rich text editing in web applications. It provides a user-friendly interface for creating and editing content. However, a vulnerability has been discovered in TinyMCE's handling of external SVG files through Object or Embed elements.
Vulnerability Detail
The vulnerability in TinyMCE allows for a cross-site scripting (XSS) attack. An attacker can exploit this vulnerability by loading an SVG image through an object or embed element, which can potentially contain a malicious XSS payload. This can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
7.0.0
This is the first release that contains the fix.
composer require tinymce/tinymce:7.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are using TinyMCE version 6.8.1 or higher, you can set the 'convert_unsafe_embeds' option to true. For earlier versions, a custom NodeFilter can be implemented to remove or modify any object or embed elements. This can be done using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Conclusion
The TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements can be mitigated by updating to version 7.0.0 or higher and enabling the 'convert_unsafe_embeds' option. It is important to stay up-to-date with security patches and follow best practices to ensure the security of your web applications.
See every vulnerability recorded for tinymce/tinymce →
FAQ
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, update to TinyMCE version 7.0.0 or higher and enable the 'convert_unsafe_embeds' option.
Yes, if you are using TinyMCE version 6.8.1 or higher, you can set the 'convert_unsafe_embeds' option to true. For earlier versions, a custom NodeFilter can be implemented.
The vulnerability was discovered by Toni Huttunen of Fraktal Oy.
You can refer to the TinyMCE release notes for version 6.8.1 and 7.0.0 for more information about the fix.
