Log in Start free

Vulnerability · Published Nov 15, 2023 · Assigned by GitHub_M

CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCE

Medium 6.1

In plain English

A medium-severity cross-site scripting in tinymce from tinymce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.7%top 46.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGettinymce5.10.9GHSA-v626-r774-j7f8
NuGettinymce6.7.3GHSA-v626-r774-j7f8
Packagisttinymce/tinymce5.10.9GHSA-v626-r774-j7f8
Packagisttinymce/tinymce6.7.3GHSA-v626-r774-j7f8
npmtinymce5.10.9GHSA-v626-r774-j7f8
npmtinymce6.7.3GHSA-v626-r774-j7f8

Affected products (as reported)

VendorProductVersions
tinymce tinymce >= 6.0.0 < 6.7.3< 5.10.9

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References