CVE-2020-17480
EPSS 0.55%Cross-site scripting vulnerability in TinyMCE
Description
### Impact A cross-site scripting (XSS) vulnerability was discovered in: the core parser, `paste` and `visualchars` plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.6 or lower and TinyMCE 5.1.3 or lower. ### Patches This vulnerability has been patched in TinyMCE 4.9.7 and 5.1.4 by improved parser logic and HTML sanitization. ### Workarounds The workarounds available are: - disable the impacted plugins - manually sanitize the content using the `BeforeSetContent` event (see below) - upgrade to either TinyMCE 4.9.7 or TinyMCE 5.1.4 #### Example: Manually sanitize content ```js editor.on('BeforeSetContent', function(e) { var sanitizedContent = ...; // Manually sanitize content here e.content = sanitizedContent; }); ``` ### Acknowledgements Tiny Technologies would like to thank Michał Bentkowski for discovering this vulnerability. ### References https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes ### For more information If you have any questions or comments about this advisory: * Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues) * Email us at [[email protected]](mailto:[email protected])
Affected packages (1)
- npm/tinymcefrom 0, < 4.9.7
References (5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-17480
- PATCHhttps://github.com/tinymce/tinymce
- WEBhttps://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95
- WEBhttps://portswigger.net/daily-swig/xss-vulnerability-patched-in-tinymce
- WEBhttps://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes