Cross-site scripting vulnerability in TinyMCE
ImpactA cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.PatchesThis vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.WorkaroundsThe workarounds available are:upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1
orenable the media plugin, which overrides the default parsing behaviour for iframes
oradd the following workaround to update the parsing schema rules for iframes:Example: Change the default schema for iframesAcknowledgementsTiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.Referenceshttps://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixesFor more informationIf you have any questions or comments about this advisory:Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)