Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditableregexp option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the noneditableregexp option, any content within an attribute is properly verified to match the configured regular expression before being added. Fix To avoid this vulnerability: Upgrade to TinyMCE 7.2.0 or higher. Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x. Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). References TinyMCE 6.8.4 TinyMCE 7.2.0 For more information If you have any questions or comments about this advisory: Email us at infosec@tiny.cloud Open an issue in the TinyMCE repo
Recommended action: Upgrade to 4.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. Patches This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Fix To avoid this vulnerability: Upgrade to TinyMCE 7.2.0 or higher. Upgrade to TinyMCE 6.8.4 or higher for TinyMCE 6.x. Upgrade to TinyMCE 5.11.0 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). Acknowledgements Tiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. References TinyMCE 6.8.4 TinyMCE 7.2.0 For more information If you have any questions or comments about this advisory: Email us at infosec@tiny.cloud Open an issue in the TinyMCE repo
Recommended action: Upgrade to 4.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower. Patches This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins. Workarounds To work around this vulnerability, either: - Upgrade to TinyMCE 5.10.0 or higher - Disable the image and link plugins Acknowledgements Tiny Technologies would like to thank Yakir6 for discovering this vulnerability. References https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes For more information If you have any questions or comments about this advisory: Email us at infosec@tiny.cloud Open an…
Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.