Impact
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or embed element and that image could potentially contain a XSS payload.
Fix
TinyMCE 6.8.1 introduced a new convert_unsafe_embeds option to automatically convert object and embed elements respective of their type attribute. From TinyMCE 7.0.0 onwards, the convert_unsafe_embeds option is enabled by default.
Workarounds
If you are using TinyMCE 6.8.1 or higher, set convert_unsafe_embeds to true. For any earlier versions, a custom NodeFilter is recommended to remove or modify any object or embed elements. This can be added using the editor.parser.addNodeFilter and editor.serializer.addNodeFilter APIs.
Acknowledgements
Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References
Impact
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an
objectorembedelement and that image could potentially contain a XSS payload.Fix
TinyMCE 6.8.1 introduced a new
convert_unsafe_embedsoption to automatically convertobjectandembedelements respective of theirtypeattribute. From TinyMCE 7.0.0 onwards, theconvert_unsafe_embedsoption is enabled by default.Workarounds
If you are using TinyMCE 6.8.1 or higher, set
convert_unsafe_embedsto true. For any earlier versions, a custom NodeFilter is recommended to remove or modify anyobjectorembedelements. This can be added using theeditor.parser.addNodeFilterandeditor.serializer.addNodeFilterAPIs.Acknowledgements
Tiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability.
References