TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

Description

A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.

Recommendation

Update the tinymce package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.0.0
• Patched version(s): 7.0.0

References

• GHSA-5359-pvf2-pw78
• www.tiny.cloud
• CVE-2024-29881
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - CVE-2024-29203
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option - CVE-2024-38356
• TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

tinymce