GoogleOSV:GHSA-5359-PVF2-PW78TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
Impact
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.
Fix
TinyMCE 6.8.1 introduced a new convert_unsafe_embeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convert_unsafe_embeds option is enabled by default.
Workarounds
If you are using TinyMCE 6.8.1 or higher, set convert_unsafe_embeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Acknowledgements
Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References
| CPE | Name | Operator | Version |
|---|---|---|---|
| tinymce/tinymce | eq | 5.8.0 | |
| tinymce | eq | 5.2.0 | |
| tinymce/tinymce | eq | 4.0.6 | |
| tinymce | eq | 6.3.2 | |
| tinymce | eq | 4.9.3 | |
| tinymce | eq | 4.9.9 | |
| tinymce | eq | 5.3.1 | |
| tinymce/tinymce | eq | 4.8.5 | |
| tinymce/tinymce | eq | 4.2.1 | |
| tinymce/tinymce | eq | 5.1.1 |
References
github.com/tinymce/tinymce
github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1
github.com/tinymce/tinymce/security/advisories/GHSA-5359-pvf2-pw78
nvd.nist.gov/vuln/detail/CVE-2024-29881
www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types
www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#convert_unsafe_embeds-editor-option-is-now-defaulted-to-true
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%