TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin

Description

A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack.

Recommendation

Update the tinymce package to the latest compatible version. Followings are version details:

• Affected version(s): **< 5.10.8

  >= 6.0.0, < 6.7.1**

• Patched version(s): **5.10.8

  6.7.1**

References

• GHSA-v65r-p3vv-jjfv
• tiny.cloud
• researchgate.net
• www.tiny.cloud
• CVE-2023-45818
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6